XSS bypassing sprintf (Assignment from CTF, no bullshit)?

Question

PHP

DISCLAIMER: Quest from CTF. There is no bullshit or malicious intent here.
There is a line of PHP code with the following content

echo sprintf('<form action="%s" method="post">', $_SERVER['PHP_SELF']).PHP_EOL;

How can I bypass sprintf and do XSS injection?

Answer 1

Just append to the URL Man, sprintf stupidly inserts the value into the string. It doesn't escape in any way. It would be possible to make simply concatenation. Nothing would have changed.
/"><script>alert(1);</script>

Answer 2

Won't protect

Answer 3

sprintf - a function for formatting strings, what does data filtering have to do with it? it can be omitted altogether.

echo "<form action=\"$_SERVER['PHP_SELF']\" method=\"post\">";