title: $_SERVER['REQUEST_URI'] - Preventing XSS and other attacks
body: <p>I'm building a form where users can upload files to my server. The upload script is in PHP and is secure but I'm unsure how secure my form action is.</p>
  
  <p>At the moment I do the following on submit:</p>
  
  <pre><code>&lt;form id="apply" method="post" enctype="multipart/form-data" action="&lt;?php echo htmlspecialchars($_SERVER['REQUEST_URI'], ENT_QUOTES, "utf-8"); ?&gt;"&gt;
  </code></pre>
  
  <p>I've read about XSS and the $_SERVER array and how to use htmlspecialchars to secure it.</p>
  
  <p>Is this enough? Should I be doing something else?</p>