use htmlspecialchars with PHP_SELF
Merge pull request #5 from larslaade/php_self-fix

use htmlspecialchars with PHP_SELF