What potential pitfalls can arise when using $PHP_SELF in PHP code?

Using $PHP_SELF in PHP code can potentially lead to security vulnerabilities such as cross-site scripting (XSS) attacks if the variable is not properly sanitized. To mitigate this risk, it is recommended to use $_SERVER['PHP_SELF'] instead, as it provides the same functionality but is more secure.

$php_self = htmlspecialchars($_SERVER['PHP_SELF']);