header(string,replace,http_response_code);
* string Required. Specifies the header string to send
* replace Optional. Indicates whether the header should replace previous or add a second header. Default is TRUE (will replace). FALSE (allows multiple headers of the same type)
* http_response_code Optional. Forces the HTTP response code to the specified value (available in PHP 4.3 and higher)
what should I concern about securiy when using this functon?
Basically as long as you don’t allow any user-supplied content to get into the header, you should be safe.