RG> Cookies are (in my opinion) a somewhat obsoleted method these
RG> days. Many servers now use "session ID's" in their place. It
RG> acheives pretty much the same purpose, but they aren't quite as
RG> persistant as cookies. The main benefit though is that
RG> sessionID's can't be disabled like cookies can (even though
RG> I've never seen a real need to disable cookies anyway). 

 If I wanted to stuff Splong's computers, I'd give serious
consideration to using a false cookie. It seems to me, to be a perfect
entry point. I know they're text, but they don';t *have* to eb
text, and you and John have already decided that text can be anything
but the 32 control characters (there are easy ways around that too).

 My fear is *any* code given access to my computer - not the cookie
itself; the *access*.

Regards,
Bob

--- BQWK Alpha 0.5