We should avoid using $_SERVER['PHP_SELF'] instead htmlentities($_SERVER['PHP_SELF']) should be preferred. This will block the XSS Hack. For more information read this : http://www.html-form-guide.com/php-form/php-form-action-self.html
BR, Shubhamoy http://shubhamoy.com/blog