Exploitation Header(AUTH BYPASS)

->header()<-[The wrong code]
~hey guys i have written this paper to show
~you the exploitability of 'header()'
~most scripts have some code like this:/admin.php/
[ if ($_COOKIE['user']=="root" && $_COOKIE['pw']=="root") {
[ $login=true;}
[ else {
[ header("Location:../login.php");
[ }
~but damn,whats wrong here?
~well,just lets test
~yeah,if i go to admin.php i get redirected to ../login.php
~but the problem is,header() doesnt stop the script[Remember!]
~it just redirects you
~so GET and POST data still can be send
~by kind of 'crlf injection' you can prepare the headers for your use
~i just call it header injection ;)