title: cross site script not working in php form
body: <p>i have a form in one of my web pages where i have given an action php page with following html syntax.</p>
  
  <pre><code>&lt;form name="form" action="test.php" method="get"&gt;
  </code></pre>
  
  <p>i have modified this to</p>
  
  <pre><code>&lt;form name="form" action="&lt;?php echo htmlspecialchars('test.php') ?&gt;" method="get"&gt;
  </code></pre>
  
  <p>but still when i type the following url in address bar</p>
  
  <pre><code>http://www.example.com/test.php/%22%3E%3Cscript%3Ealert('hacked')%3C/script%3E
  </code></pre>
  
  <p>it outputs in browser </p>
  
  <pre><code>http://www.example.com/test.php/"&gt;&lt;script&gt;alert('hacked')&lt;/script&gt;
  </code></pre>
  
  <p>which is wrong.I want to secure my page for cross site scripting.please guide me where i m doing wrong.</p>