Are there any security concerns to consider when using PHP_SELF for form actions?

Using PHP_SELF for form actions can pose a security risk as it opens the door to potential XSS attacks. To mitigate this risk, it is recommended to use htmlspecialchars() function to sanitize the PHP_SELF variable before using it in the form action attribute.

<form action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]); ?>" method="post">