Can a site be hacked via $_SERVER['REQUEST_URI'] ?

Question

PHP

Good afternoon!
I thought about this question. If the form says action="$_SERVER['REQUEST_URI']" or where in the href attribute of the tag , is it possible somehow to inject xss or...

Answer 1

It is possible if the data is not filtered.
The form

<form action="<?=$_SERVER['REQUEST_URI']?>">
...
</form>

when requested: host.com/form/%22%3E%3Cscript%3Ealert( 'xss')%3C/script%3E%3Cbr%20class=%22demo
will become:

<form action="http://host.com/form/"><script>alert('xss')</script><br class="demo">
...
</form>

Answer 2

in the form you can not specify at all, but leave the attribute empty. but the main thing is to be