What are the potential security risks associated with using $_SERVER['PHP_SELF'] in PHP code?

Using $_SERVER['PHP_SELF'] in PHP code can pose a security risk known as Cross-Site Scripting (XSS) attacks. This is because the variable may contain user-input data that has not been properly sanitized, allowing malicious scripts to be injected into the code. To mitigate this risk, it is recommended to use htmlspecialchars() function to sanitize the input before using it.

$form_action = htmlspecialchars($_SERVER['PHP_SELF']);