這是很好的PHP_SELF或phpfilename.php

Question

朋友任何機構可以告訴我這是PHP_SELF或phpfilename.php

有些人在形式上行動「$ _ SERVER [PHP_SELF]」使用，一些使用「updatedata.php之間良好「哪一個很好，爲什麼它很好

Answer 1

你不應該使用PHP_SELF它不是真的有問題，如果你在一個鏈接中回顯那個變量，例如你有XSS攻擊，因爲所有的參數都被寫入站點。

PHP_SELF and XSS

這裏有一些很酷的答案。因此，最好使用文件的完整名稱，並將需要的參數過濾到文件名後面。

Answer 2

Both are doing same job.But `PHP_SELF` is takes the pathname dynamically 
If we use filename.php its should be static 

'PHP_SELF' 

     The filename of the currently executing script, relative to the document root. For instance, $_SERVER['PHP_SELF'] in a script at the address http://example.com/test.php/foo.bar would be /test.php/foo.bar. The __FILE__ constant contains the full path and filename of the current (i.e. included) file. If PHP is running as a command-line processor this variable contains the script name since PHP 4.3.0. Previously it was not available. 

    PATH_INFO(Filename.php) doesn't seem to be documented...