title: Is it safe to use a PHP_SELF value in a header redirect?
body: <p>i.e. store it in a session, and then when the user logs in, redirect to that page?</p>
  
  <pre><code>$_SESSION['last_page'] = $_SERVER['PHP_SELF'];    
  //(in a common file on all pages)
  </code></pre>
  
  <p>and then after logging in:</p>
  
  <pre><code>header('location: ' . $_SESSION['last_page']);`
  </code></pre>
  
  <p>I'm wondering because I read that people can modify the values of certain keys in <code>$_SERVER</code></p>
  
  <p>Would it be better to use <code>SCRIPT_NAME</code> instead or is <code>PHP_SELF</code> fine?</p>