[SECURITY] Fixing XSS in PHP_SELF

Fixes #1364 once merged.