What potential pitfalls should developers be aware of when using $_SERVER['PHP_SELF'] to retrieve the script name?

Using $_SERVER['PHP_SELF'] to retrieve the script name can expose your application to potential security vulnerabilities, such as cross-site scripting (XSS) attacks. To mitigate this risk, it is recommended to use htmlentities() function to sanitize the output before displaying it to the user.

$script_name = htmlentities($_SERVER['PHP_SELF']);
echo $script_name;