$PHP_SELF and $_SERVER['PHP_SELF']

[freak]

What is the difference between $PHP_SELF and $_SERVER['PHP_SELF']?

Why do people use $_SERVER['PHP_SELF'] if it is longer and more difficult to type?

[HardCoded]

Just in case your code ever has to run where register_globals is off.

[codyrockx]

using it through the $_SERVER array is always better, despite it `taking more time` because of more typing; it'll save you many hassles. Among knowing exactly where it came from, you will then avoid any server change issues that may result in your program falling apart.

[mullen]

Think about what would happen if someone added "...?PHP_SELF=blah" to the end of the URL. Without accessing PHP_SELF through the superglobal $_SERVER array, you are introducing easily avoidable security vulnerabilities.

[vinyl-junkie]

Always have register globals off, and then you don't have to worry what a visitor might put at the end of a URL.

I've seen some pretty strange URL endings in my server log lately. They've all up on my 404 page.