PHP form XSS vulnerability I'd like to ask if this PHP/HTML code has any flaws which can be exploited by the potential aggressor:

&lt;form method='post' action='&lt;?php echo $_SERVER['PHP_SELF']; ?&gt;'&gt;
&lt;input type='text' name='foo' value='&lt;?php echo htmlspecialchars($_POST['foo']); ?&gt;' /&gt; 
&lt;input type='submit' value='bar' /&gt;
&lt;/form&gt;


I'm aware that it can be exploited by calling script like this http://foo.bar/baz.php/'&gt;&lt;script&gt;alert('xss')&lt;/script&gt;&lt;foo' and 

&lt;?php echo $_SERVER['PHP_SELF']; ?&gt;


should be replaced with 

&lt;?php echo htmlentities($_SERVER['PHP_SELF']); ?&gt; or &lt;?php echo htmlspecialshars($_SERVER['PHP_SELF']); ?&gt;


Are there any other possible ways to conduct XSS attack on this piece of code? If so, how can I secure this form?

@Update: Ok, I've just found another possible attack - entering code like ' onmouseover='alert(String.fromCharCode(88,83,83,33)); (with the apostrophe in the beginning) into the text field, which causes simple 'XSS!' alert. It can be avoided by changing &lt;?php echo htmlspecialchars($_POST['foo']); ?&gt; to &lt;?php echo str_replace('\'', '&amp;#39;', htmlspecialchars($_POST['foo'])); ?&gt;
For single-quoted attributes, use htmlspecialchars($text, ENT_QUOTES).

Depending on what this does, you might want to implement some sort of protection against CSRF attacks.

You might also want to check $_SERVER['SCRIPT_NAME'].

Other than that, this code seems reasonable.