header() in setcookie() nehala delovati ?!

<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Prijava</title>

<?php
$con = mysql_connect("i","like","cookiez....");
mysql_select_db('....NOT', $con);
if (isset($_COOKIE['username']) AND isset($_COOKIE['password']))
{
    $username = $_COOKIE['username'];
    $password = $_COOKIE['password'];

} else if ($_POST['username'] AND $_POST['password'])
{
    $username = (string)$_POST['username'];
    $password = (string)md5($_POST['password']);
}
else
{
    echo "<script> window.location.replace('index.php') </script>";
}


// ---FUNC--- for getting CLIENT IP
function get_ip() {
    if (getenv("HTTP_CLIENT_IP"))
        $ip = getenv("HTTP_CLIENT_IP");
    else if(getenv("HTTP_X_FORWARDED_FOR"))
        $ip = getenv("HTTP_X_FORWARDED_FOR");
    else if(getenv("REMOTE_ADDR"))
        $ip = getenv("REMOTE_ADDR");
    else
        $ip = "UNKNOWN";
    return $ip;
};

$query = mysql_query("SELECT * FROM users WHERE username = '$username' AND password = '$password'");
if (mysql_num_rows($query) == 0)
{
    echo "<script> window.location.replace('index.php') </script>";

} else {
while ($row = mysql_fetch_array($query))
{
    if (isset($_COOKIE['username']) == False/* število stoplcev v mySQL * 2 */)
    {
        setcookie('username', $row['username'], time()+60*60*24);
        setcookie('password', $row['password'], time()+60*60*24);
    }

    echo  'Prijava uspešna za "' . $row['username'] . '"' . ' ..... preusmerjanje!';

};

$current_ip = get_ip();
mysql_query("UPDATE users SET ip = CONCAT(ip,'  $current_ip ||') WHERE username = '$username' AND password = '$password'");
/* echo "<script> window.location.replace('accountant.php') </script>"; */
        }
		print_r($_COOKIE); // test code

?>

    $username = (string)$_POST['username'];
    $password = (string)md5($_POST['password']);