What are the limitations of using htmlspecialchars($_SERVER['PHP_SELF']) in preventing path manipulation vulnerabilities?

Using htmlspecialchars($_SERVER['PHP_SELF']) alone is not sufficient to prevent path manipulation vulnerabilities because it only escapes HTML entities in the URL. To fully protect against path manipulation attacks, you should use basename() function to extract the filename from the path, ensuring that only the filename is used in any subsequent operations.

$filename = basename($_SERVER['PHP_SELF']);
echo htmlspecialchars($filename);