You really should sanatize your variables man. With the way it is there if I were a spammer I could use your script as my own redirect tool. And now that I think of it, using header like that to redirect complete url's is kinda dumb. Make a database hold the urls you want to use then call them by id.
See sig for example.