diff --git a/web/includes/Frame.php b/web/includes/Frame.php
index 74a18ef59..d4c2a4dee 100644
--- a/web/includes/Frame.php
+++ b/web/includes/Frame.php
@@ -50,9 +50,8 @@ class Frame {
   }
 
   public function getImageSrc( $show='capture' ) {
-    
-    return $_SERVER['PHP_SELF'].'?view=image&fid='.$this->{'FrameId'}.'&eid='.$this->{'EventId'}.'&show='.$show;
-    #return $_SERVER['PHP_SELF'].'?view=image&fid='.$this->{'Id'}.'&show='.$show.'&filename='.$this->Event()->MonitorId().'_'.$this->{'EventId'}.'_'.$this->{'FrameId'}.'.jpg';
+    return '?view=image&fid='.$this->{'FrameId'}.'&eid='.$this->{'EventId'}.'&show='.$show;
+    #return '?view=image&fid='.$this->{'Id'}.'&show='.$show.'&filename='.$this->Event()->MonitorId().'_'.$this->{'EventId'}.'_'.$this->{'FrameId'}.'.jpg';
   } // end function getImageSrc
 
 	public static function find( $parameters = array(), $options = NULL ) {
diff --git a/web/includes/Server.php b/web/includes/Server.php
index 65721214d..ea633c4be 100644
--- a/web/includes/Server.php
+++ b/web/includes/Server.php
@@ -117,7 +117,8 @@ class Server {
     if ( isset($this->{'PathToIndex'}) and $this->{'PathToIndex'} ) {
       return $this->{'PathToIndex'};
     }
-    return $_SERVER['PHP_SELF'];
+    // We can't trust PHP_SELF to not include an XSS vector. See note in skin.js.php.
+    return preg_replace('/\.php.*$/i', '.php', $_SERVER['PHP_SELF']);
   }
 
   public function UrlToIndex( $port=null ) {
diff --git a/web/includes/actions/groups.php b/web/includes/actions/groups.php
index 200f65f99..22d138240 100644
--- a/web/includes/actions/groups.php
+++ b/web/includes/actions/groups.php
@@ -43,7 +43,7 @@ if ( $action == 'delete' ) {
       $Group->delete();
     }
   }
-  $redirect = ZM_BASE_URL.$_SERVER['PHP_SELF'].'?view=groups';
+  $redirect = '?view=groups';
   $refreshParent = true;
 } # end if action
 ?>
diff --git a/web/includes/actions/login.php b/web/includes/actions/login.php
index b497b29f5..5e35987c8 100644
--- a/web/includes/actions/login.php
+++ b/web/includes/actions/login.php
@@ -29,7 +29,7 @@ if ( $action == 'login' && isset($_REQUEST['username']) && ( ZM_AUTH_TYPE == 're
     $view = 'login';
   } else {
     $view = 'postlogin';
-    $redirect = ZM_BASE_URL.$_SERVER['PHP_SELF'].'?view=console';
+    $redirect = '?view=console';
   }
 }
 ?>
diff --git a/web/includes/actions/montage.php b/web/includes/actions/montage.php
index 7182ba2dc..3040fd83a 100644
--- a/web/includes/actions/montage.php
+++ b/web/includes/actions/montage.php
@@ -40,7 +40,7 @@ if ( isset($_REQUEST['object']) ) {
       $_SESSION['zmMontageLayout'] = $Layout->Id();
       setcookie('zmMontageLayout', $Layout->Id(), 1);
       session_write_close();
-      $redirect = ZM_BASE_URL.$_SERVER['PHP_SELF'].'?view=montage';
+      $redirect = '?view=montage';
     } // end if save
 
   } # end if isset($_REQUEST['object'] )
diff --git a/web/includes/actions/options.php b/web/includes/actions/options.php
index 263a592f8..d7853ec9e 100644
--- a/web/includes/actions/options.php
+++ b/web/includes/actions/options.php
@@ -89,7 +89,7 @@ if ( $action == 'delete' ) {
     case 'lowband' :
       break;
     }
-    $redirect = ZM_BASE_URL.$_SERVER['PHP_SELF'].'?view=options&tab='.$_REQUEST['tab'];
+    $redirect = '?view=options&tab='.$_REQUEST['tab'];
   }
   loadConfig(false);
   return;
diff --git a/web/includes/actions/privacy.php b/web/includes/actions/privacy.php
index 19c4061ea..99bbd7150 100644
--- a/web/includes/actions/privacy.php
+++ b/web/includes/actions/privacy.php
@@ -28,12 +28,12 @@ if ( ($action == 'privacy') && isset($_REQUEST['option']) ) {
   case 'decline' :
     dbQuery("UPDATE Config SET Value = '0' WHERE Name = 'ZM_SHOW_PRIVACY'");
     dbQuery("UPDATE Config SET Value = '0' WHERE Name = 'ZM_TELEMETRY_DATA'");
-    $redirect = ZM_BASE_URL.$_SERVER['PHP_SELF'].'?view=console';
+    $redirect = '?view=console';
     break;
   case 'accept' :
     dbQuery("UPDATE Config SET Value = '0' WHERE Name = 'ZM_SHOW_PRIVACY'");
     dbQuery("UPDATE Config SET Value = '1' WHERE Name = 'ZM_TELEMETRY_DATA'");
-    $redirect = ZM_BASE_URL.$_SERVER['PHP_SELF'].'?view=console';
+    $redirect = '?view=console';
     break;
   default: # Enable the privacy statement if we somehow submit something other than accept or decline
     dbQuery("UPDATE Config SET Value = '1' WHERE Name = 'ZM_SHOW_PRIVACY'");
diff --git a/web/includes/functions.php b/web/includes/functions.php
index cbb54f1c9..f0e087d48 100644
--- a/web/includes/functions.php
+++ b/web/includes/functions.php
@@ -294,7 +294,7 @@ function getImageStreamHTML( $id, $src, $width, $height, $title='' ) {
 
 function outputControlStream( $src, $width, $height, $monitor, $scale, $target ) {
 ?>
-  <form name="ctrlForm" method="post" action="<?php echo $_SERVER['PHP_SELF'] ?>" target="<?php echo $target ?>">
+  <form name="ctrlForm" method="post" action="?" target="<?php echo $target ?>">
     <input type="hidden" name="view" value="blank">
     <input type="hidden" name="mid" value="<?php echo $monitor['Id'] ?>">
     <input type="hidden" name="action" value="control">
@@ -364,7 +364,7 @@ function getWebSiteUrl( $id, $src, $width, $height, $title='' ) {
 
 function outputControlStill( $src, $width, $height, $monitor, $scale, $target ) {
   ?>
-  <form name="ctrlForm" method="post" action="<?php echo $_SERVER['PHP_SELF'] ?>" target="<?php echo $target ?>">
+  <form name="ctrlForm" method="post" action="?" target="<?php echo $target ?>">
     <input type="hidden" name="view" value="blank">
     <input type="hidden" name="mid" value="<?php echo $monitor['Id'] ?>">
     <input type="hidden" name="action" value="control">
diff --git a/web/skins/classic/js/skin.js.php b/web/skins/classic/js/skin.js.php
index 1d0cfd61c..a9f6b85af 100644
--- a/web/skins/classic/js/skin.js.php
+++ b/web/skins/classic/js/skin.js.php
@@ -29,7 +29,11 @@ var AJAX_TIMEOUT = <?php echo ZM_WEB_AJAX_TIMEOUT ?>;
 var navBarRefresh = <?php echo 1000*ZM_WEB_REFRESH_NAVBAR ?>;
 
 var currentView = '<?php echo $view ?>';
-var thisUrl = '<?php echo ZM_BASE_URL.$_SERVER['PHP_SELF'] ?>';
+<?php
+/* We can't trust PHP_SELF on a path like /index.php/"%3E%3Cimg src=x onerror=prompt('1');%3E which
+   will still load index.php but will include the arbitrary payload after `.php/`. To mitigate this,
+   try to avoid using PHP_SELF but here I try to replace everything after '.php'. */ ?>
+var thisUrl = '<?php echo ZM_BASE_URL.preg_replace('/\.php.*$/i', '.php', $_SERVER['PHP_SELF']) ?>';
 var skinPath = '<?php echo ZM_SKIN_PATH ?>';
 var serverId = '<?php echo defined('ZM_SERVER_ID') ? ZM_SERVER_ID : '' ?>';