use htmlspecialchars with PHP_SELF

The security scanner Wapiti claimed that $_SERVER['PHP_SELF'] is vulnerable to XSS.
Using htmlspecialchars fixes that, see https://stackoverflow.com/questions/6080022/php-self-and-xss.