PHP's $_SERVER suportglobal contains some values that come from the user - be careful what you use!
This last one, $_SERVER, on the surface looks like something quite useful - it gives us access to values like the server address (IP), the protocol the request was made with and various other things. But it pulls it all from the server itself, right?
See, there's a few values that PHP drops in based on the current request. If you assume that these values are set in stone, you could be in for a world of hurt as would-be attackers walk all over your application and inject their content as they please.
PHP_SELF: Filename of the current script (relative to docroot). If you want to use this always filter!
HTTP_USER_AGENT: The client can set this to pretty much whaever they want (it could be "fuzzy bunny" if they wanted it to be).
One easy way to filter out a lot of the issues is to pass these values through a call to strip_tags or htmlspecialchars to remove malicious content. Obviously, this is pretty high-level filtering, so you should still take some care when using the result. Nothing is infalable and users are tricky things - always filter!
By the way, one of the worst offenders I've seen is PHP_SELF. I've seen waaaaaay too many examples that use it in a <form> tag.
For more information on this, check out the manual page for $_SERVER in the PHP.net manual.