Crikey, how convoluted. So the identical cookie has to be set on each subdomain separately? Why can't it just be set on the overall domain and be done with it? And how does the php know how many subdomains you've got? The quoted bit looks as if they're all hard-coded. Does it really come from a database?