What potential issues or vulnerabilities can arise from using $_SERVER['PHP_SELF'] in PHP code?

Using $_SERVER['PHP_SELF'] in PHP code can lead to potential security vulnerabilities such as Cross-Site Scripting (XSS) attacks if the variable is not properly sanitized. To mitigate this risk, it is recommended to use htmlspecialchars() function to escape any HTML characters before outputting the value of $_SERVER['PHP_SELF'].

$php_self = htmlspecialchars($_SERVER['PHP_SELF']);
echo $php_self;