Security of form action to a different webpage

Most of my forms POST to the same page, I use:

action="<?php echo $editFormAction; ?>"

then:

$editFormAction = $_SERVER['PHP_SELF'];

if (isset($_SERVER['QUERY_STRING'])) {

$editFormAction .= "?" . htmlentities($_SERVER['QUERY_STRING']);

}

However I have some forms that POST to a new url / page with the form action being just the relative url:

action = "delete-item.php"

Should I be using html entities in the form action to prevent script attack and redirecting the form to somewhere else?

action = <?php echo htmlentities; ?>"delete-item.php"

Would this be correct or is there a better way to do this?

On the same subject then should all my links, including general content pages and user administration pages, also echo html entities to prevent attack or am I misunderstanding something?

Comments, help and advise much appreciated as always.

Thank you in advance.