PHP Code
form action="<?php echo htmlentities($_SERVER['PHP_SELF']) ?>"
 method="post">
....
 

is what i do smile

or go total paranoid (which i don't) and do:

PHP Code
substr($_SERVER['PHP_SELF'], 0, (strlen($_SERVER['PHP_SELF']) - @strlen($_SERVER['PATH_INFO']))); 

for the echo.. i had that del.icio.us'd somewhere laugh