What are the potential risks of using PHP_SELF in URL path generation?

Using PHP_SELF in URL path generation can expose your application to potential security risks such as cross-site scripting (XSS) attacks or injection attacks. To mitigate these risks, it's recommended to use htmlspecialchars() function to escape any user input before outputting it to the page.

$url = htmlspecialchars($_SERVER['PHP_SELF']);
echo $url;