Use SCRIPT_NAME instead of PHP_SELF which won't send the PATH_INFO, this...

Use SCRIPT_NAME instead of PHP_SELF which won't send the PATH_INFO, this prevents XSS in old browsers. Thanks to Nico Golde.