Where to put the header function - php

Question

Okay this is definitley an easy question and a stupid one but since I have been developing on localhost i didn't even realise it was a problem. The header to redirect to members page in the loginscript is not working because it is positioned incorrectly. This did not cause a problem on wamp but is on the live server. The script is included in an html file for reasons too long to tell here. Nothing is echoed in the script until something goes wrong but then the script is stopped. Where should i put the redirect header?
Here is the login script:
<?php
// Connects to your Database
include ("database.php");
//Checks if there is a login cookie
if(isset($_SESSION['username']))
//if there is, it logs you in and directes you to the members page
{
echo '<div id="probwarn"><t1><b>You are already logged in! You do not need to do it again.</b></t1></div>';
}
//if the login form is submitted
if (isset($_POST['submit'])) { // if form has been submitted
$flag = 0; // Safety net, if this gets to 1 at any point in the process, we don't upload.
// makes sure they filled it in
if(!$_POST['username'] | !$_POST['pass']) {
echo('<div id="probwarn"><t1>You did not fill in a required field.</t1></div>');
$flag = $flag + 1;
}
// checks it against the database
$pass = htmlspecialchars(mysql_real_escape_string($_POST['pass']));
$username = htmlspecialchars(mysql_real_escape_string($_POST['username']));
$check = mysql_query("SELECT * FROM members WHERE username = '".$username."'")or die(mysql_error());
//Gives error if user dosen't exist
$check2 = mysql_num_rows($check);
if ($check2 == 0) {
if($flag == 0) {
echo('<div id="probwarn"><t1>You must <b>register</b> first.</t1></div>') ;
}
$flag = $flag + 1;
}
$check = mysql_query("SELECT * FROM members WHERE username = '".$username."'")or die(mysql_error());
$pass = htmlspecialchars(mysql_real_escape_string($_POST['pass']));
$username = htmlspecialchars(mysql_real_escape_string($_POST['username']));
while($info = mysql_fetch_array( $check ))
{
$_POST['pass'] = stripslashes($_POST['pass']);
$info['password'] = stripslashes($info['password']);
$_POST['pass'] = md5($_POST['pass']);
//gives error if the password is wrong
if ($_POST['pass'] != $info['password']) {
if($flag == 0) {
echo('<div id="probwarn"><t1>Incorrect password, please try again.</t1> </div>');
$flag ++;
} }
}
// if login is ok then we add a cookie
if($flag == 0) {
$pass = htmlspecialchars(mysql_real_escape_string($_POST['pass']));
$username = htmlspecialchars(mysql_real_escape_string($_POST['username']));
$_SESSION['username']=$username;
$_SESSION['password']=$pass;
//then redirect them to the members area
//THIS IS THE HEADER
header("Location: ../members.html");
}
}
else
// if they are not logged in
?>
LOGIN FORM IS USUALLY HERE

Answer 1

You forgot to exit after setting a Location header. Unless you know exactly what you're doing, you should ALWAYS put exit (or die()) after a Location header.

Answer 2

you can use header('Location: address') everywhere of your code, but it's better to use exit() function after header, if redirection not executed, other codes doesn't execute.