Why use SERVER PHP SELF instead of

Question

In a form on a PHP page  you can use     lt form action   lt  php echo   SERVER  PHP SELF      gt       gt    or   lt form action         gt    or   lt form action        gt    in the action attribute of the form  Since echo   SERVER  PHP SELF   does not pass variables for using GET and you have to use     why would you use that or        I m asking because it took me some time to figure out that the variables are not passed with   SERVER  PHP SELF    Thanks

User · Answer

There is no difference  The   SERVER  PHP SELF   just makes the execution time slower by like 0 000001 second

User · Answer

When you insert ANY variable into HTML  unless you want the browser to interpret the variable itself as HTML  it s best to use htmlspecialchars   on it  Among other things  it prevents hackers from inserting arbitrary HTML in your page   The value of   SERVER  PHP SELF   is taken directly from the URL entered in the browser  Therefore if you use it without htmlspecialchars    you re allowing hackers to directly manipulate the output of your code   For example  if I e-mail you a link to http   example com   gt  lt script gt malicious code here   lt  script gt  lt span class   and you have  lt form action   lt  php echo   SERVER  PHP SELF     gt   gt   the output will be    lt form action  http   example com   gt  lt script gt malicious code here   lt  script gt  lt span class    gt    My script will run  and you will be none the wiser  If you were logged in  I may have stolen your cookies  or scraped confidential info from your page   However  if you used  lt form action   lt  php echo htmlspecialchars   SERVER  PHP SELF      gt   gt   the output would be    lt form action  http   example com  amp quot  amp gt  amp lt script amp gt cookie stealing code   amp lt  script amp gt  amp lt span class  amp quot   gt    When you submitted the form  you d have a weird URL  but at least my evil script did not run   On the other hand  if you used  lt form action    gt   then the output would be the same no matter what I added to my link  This is the option I would recommend

User · Answer

The action attribute will default to the current URL  It is the most reliable and easiest way to say  submit the form to the same place it came from    There is no reason to use   SERVER  PHP SELF    and   doesn t submit the form at all  unless there is a submit event handler attached that handles the submission

User · Answer

I know that the question is two years old  but it was the first result of what I am looking for  I found a good answers and I hope I can help other users   Look at this  I will make this brief    use the   SERVER  PHP SELF   Variable with htmlspecialchars       htmlspecialchars   SERVER  PHP SELF       PHP SELF returns the filename of the currently executing script  The htmlspecialchars   function converts special characters to HTML entities   --  NO XSS

User · Answer

In addition to above answers  another way of doing it is   SERVER  PHP SELF   or simply using an empty string is to use   DIR    OR If you re on a lower PHP version   lt 5 3   a more common alternative is to use dirname   FILE    Both returns the folder name of the file in context     EDIT As Boann pointed out that this returns the on-disk location of the file  WHich you would not ideally expose as a url  In that case dirname   SERVER  PHP SELF    can return the folder name of the file in context

User · Answer

Using an empty string is perfectly fine and actually much safer than simply using   SERVER  PHP SELF     When using   SERVER  PHP SELF   it is very easy to inject malicious data by simply appending   lt script gt     after the whatever php part of the URL so you should not use this method and stop using any PHP tutorial that suggests it

[php] Why use $_SERVER['PHP_SELF'] instead of ""

Examples related to php

Examples related to forms