both POST and GET have the same amount of vulnerabilities ... it's just POST requires TamperData or a URLSnooper addon to change the POST'd data.

anyway, you cannot 'refresh' or 'location' via php headers to POST data .. you'd have to use a HTML form with the method set to POST and use javascript to autosubmit it (as I assume you want to autosubmit it since your PHP script is refreshing).

Edit: like marplo suggested, the best way to make it not vulnerable is to store the GET into a SESSION rather so it's not visible / tamperable by the front-end user (since it'd be handled server-side).

POST is user-side just like GET - so SESSION would be your best solution.