title: why <form method="post" action="<?php echo $_SERVER["PHP_SELF"];?>"> will cause the XSS
body: <p>Today I read the w3school to learn php by myself. 
   It says <code>&lt;form method="post" action="&lt;?php echo $_SERVER["PHP_SELF"];?&gt;"&gt;</code>maybe cause the XSS when someone enters the some URL,such as "<a href="http://www.example.com/test_form.php/%22%3E%3Cscript%3Ealert" rel="nofollow">http://www.example.com/test_form.php/%22%3E%3Cscript%3Ealert</a>('hacked')%3C/script%3E".
   I don't konw why enter this URL will cause the $_SERVER["PHP_SELF"] return different result.Can someone tell the reason to me.Thanks.</p>