if ($q->cookie('user') eq "Administrator") {
DoAdministratorTasks();
}
Unfortunately, this code can be bypassed. The attacker can set the cookies independently so that the code does not check the username and password. The attacker could do this with an HTTP request containing headers such as: