Suppose I have a website http://www.mysite.com.
Can the $_COOKIE array ever contain cookies that were set by domains other than www.mysite.com, if I am using $_COOKIE via PHP code on the domain www.mysite.com?
My understanding (which is quite limited!) is that a domain can only access cookies that it set itself, which means that $_COOKIE could only contain cookies which were set by the domain. Is this correct?
No. Only a nonfunctional browser would do such a thing.
Only the client can view all the cookies for all separate domains, the browser makes sure to send only the cookies related to the current domain and non other.