use htmlspecialchars with PHP_SELF