A question about $_SERVER["PHP_SELF"]

[phppup]

Are these two pieces of code equal in risk?

<form method="post" action="<?php echo $_SERVER["PHP_SELF"];?>">
  
  and
  
<form method="post" action="">

Do they perform the same action?

Are both vulnerable? Best practice to minimize vulnerability?

Will using prepared statements nullify a hacking attempt?

I was doing some reading and thought I'd ask the experts here.

[Barand]

Best to use the third version...

<form method="post">

PHP_SELF is vulnerable.

Prepared statements protect against SQL injection attacks. There are still other types out there.

[phppup]

So     <form method="post">     will default to a SELF process that is slightly safer than the aforementioned?

[maxxd]

Omitting the action attribute from a form tag is the current best practice, yes. As far as data/form security goes, it takes more than just that - it takes things like using a nonce and validating and sanitizing any user-submitted data before you do anything with it. Even then, you'll need to use prepared statements for any database interactions that involve said user-submitted data.