$_SERVER['PHP_SELF'] Where should this be used? I have heard that this can cause security issues.... I have tried searching, but it is abit hit and miss on where it should be used. It would be greate if someone could clear this up for me.... thanks.
Some people use it in a forms action parameter, but you should NOT use it as it isn't required or safe
As Jay said, it's mostly used in form actions. Instead of saying <form action="staticFileName.php"> you can just say <form action="<? echo $_SERVER['PHP_SELF']; ?>"> The problem with doing this is that PHP_SELF will print out all elements sent to the current URL. If the user went to the URL "phpFormProcessor.php/badXSScodeHere" instead of just "phpFormProcessor.php", they could pass HTML or JS code to your page. You can still use PHP_SELF though, just use basename() to sanitize the data.
hmmm, ok thanks... if my page was: mypage.php?id=6&c=2 could I make a safe php_self by using basename() or something similer...