What are the potential issues with using $PHP_SELF in PHP code?

Using $PHP_SELF in PHP code can pose a security risk as it can be manipulated by malicious users to perform cross-site scripting attacks. To mitigate this risk, it is recommended to use $_SERVER['PHP_SELF'] instead, as it provides a more secure way to access the current script name.

$current_script = htmlentities($_SERVER['PHP_SELF']);
echo "Current script: " . $current_script;