SCRIPT_NAME solves all the problems mentioned in this thread - it's just the script name, without any extra garbage that might be tacked on by the user. PHP_SELF explicitly includes that extra garbage, so solutions in this thread that involve stripping the garbage off of PHP_SELF to make it safe are really, really missing the point - just use SCRIPT_NAME instead. Please don't use FORM ACTION=”"; according to the spec, what the browser does with that is undefined, so even if it works in current browsers, it might not work in future ones