$_SERVER['PHP_SELF'] vs $_SERVER['SCRIPT_FILENAME']

PHP
1

When I echo both, I would get this output

/contactform/form_process.php
/Applications/XAMPP/xamppfiles/htdocs/php/contactform/form_process.php

While first I was using PHP_SELF but suddenly I read some users comments and they prefer for the SCRIPT_FILENAME, As i want to use in form and to avoid xss and such codes. Which one should you prefer?

2

if you think about the action=... part of your form, just let it empty.

3

As you can tell from the output, the second option will never work, as it simply gives you wrong path.

Better yet, as it was noted above, simply omit action parameter in the form tag, to make your form sent to the same URL.

4

Or you could just do this -

$phpSelf = filter_input(INPUT_SERVER, 'PHP_SELF', FILTER_SANITIZE_URL);
$path_parts = pathinfo($phpSelf);
$basename = $path_parts['basename']; // Use this variable for action='':
$pageName = ucfirst($path_parts['filename']);

if you’re concerned about safety…

5

Or

<?php
$sn = basename($_SERVER['SCRIPT_NAME']);
// Or
$sn = basename(__FILE__);

Anyone know if $_SERVER['SCRIPT_NAME'] should be sanitized too before use? I have been using it in my apps. Atleast Acunetix and Nessus scans did not report any XSS vulnerabilities if I remember correctly.

6

Obviously, your code will never work for the OP.

Nor $_SERVER['SCRIPT_NAME'] should be ever used in any front-end context, where REQUEST_URI is the only reliable address source

7

This topic was automatically closed 91 days after the last reply. New replies are no longer allowed.