Is it safe to use a PHP_SELF value in a header redirect?
<p>i.e. store it in a session, and then when the user logs in, redirect to that page?</p>

<pre><code>$_SESSION['last_page'] = $_SERVER['PHP_SELF'];    
//(in a common file on all pages)
</code></pre>

<p>and then after logging in:</p>

<pre><code>header('location: ' . $_SESSION['last_page']);`
</code></pre>

<p>I'm wondering because I read that people can modify the values of certain keys in <code>$_SERVER</code></p>

<p>Would it be better to use <code>SCRIPT_NAME</code> instead or is <code>PHP_SELF</code> fine?</p>
