What are the potential pitfalls of using PHP_SELF instead of SCRIPT_NAME?

Using PHP_SELF instead of SCRIPT_NAME can pose a security risk as PHP_SELF can be manipulated by attackers to inject malicious code or perform attacks like Cross-Site Scripting (XSS). To mitigate this risk, it's recommended to use SCRIPT_NAME instead as it provides the actual filename of the currently executing script.

// Using SCRIPT_NAME instead of PHP_SELF to avoid security risks
$script_name = $_SERVER['SCRIPT_NAME'];