For ghpille at hotmail dot:
Actually, RFC 6265 describes, in section 4.1.1., that quoted or not, the value of a cookie can be specified using "US-ASCII characters excluding CTLs, whitespace DQUOTE, comma, semicolon, and backslash". Therefore, your example is an invalid cookie, according to this document, which replaces RFC 2965, and the value of a "Set-Cookie" header field can be parsed using a simple explode(';', $cookie_field_value) call.