refined reflected XSS and added PHP_SELF checks