What is the purpose of $_SERVER['PHP_SELF'] in PHP?

The purpose of $_SERVER['PHP_SELF'] in PHP is to retrieve the filename of the currently executing script. However, using $_SERVER['PHP_SELF'] in forms can make your application vulnerable to cross-site scripting (XSS) attacks. To prevent this vulnerability, you should sanitize the value of $_SERVER['PHP_SELF'] before using it in your code. 

<form action="<?php echo htmlspecialchars($_SERVER['PHP_SELF']); ?>" method="post">
    <!-- Form fields go here -->
</form>

Keywords

$_SERVER PHP_SELF server variable form submission security vulnerability

Related Questions