$_SERVER['PHP_SELF']; error

[adi_das]

I have a code built in, which is in my localhost and connects to an external database. I have set my connections right, and when I try to login via the page, after pressing submit, my url changes to

localhost/<? echo $_SERVER['PHP_SELF']; ?>?action=validate

 

And I get this displayed.

Quote

 

    Access forbidden!

 

    You don't have permission to access the requested object. It is either read-protected or not readable by the server.

 

    If you think this is a server error, please contact the webmaster.

 

 

where validate is for validating. Any help?

[BlueSkyIS]

my powers of telepathy say there is a problem on line 322. can you post the code to see if I'm right? or at least so we can try to help you figure out the problem?

[Pikachu2000]

You shoudn't be using $_SERVER['PHP_SELF'] as a form action to begin with. It is a known XSS vulnerability. Use action="" to submit a form to itself. And while you're at it, don't use short <? open tags, use the full <?php tag syntax, since that's probably the cause of this particular problem.

[adi_das]

Thanks for your replies. I cannot post the full code, since it's confidential. Sorry.

 

And using the full syntax did the trick but isn't allowing me to login. It just refreshes the page. Weird.