title: How is SCRIPT_NAME dangerous in PHP?
body: <p>I am using the line below in my php blog site, how is that a danger ?   </p>
  
  <pre><code>&lt;form action="&lt;?php echo $SCRIPT_NAME. "?id=" . $validentry; ?&gt;" method="post"&gt;
  </code></pre>
  
  <p>I have <code>register_global off</code> and <code>magic_quotes_gpc()</code> also off.<br>
  I am using php 5.2.<br>
  I tried <code>$_SERVER['php_self']</code>, but that didn't work.</p>