PHP String htmlspecialchars() Function

---

---

The PHP String htmlspecialchars() function is used to convert special characters to HTML entities. So basically it converts all pre-defined characters to HTML entities. The predefined characters are −

• & (ampersand) converted as &

• " (double quote) converted as "

• ' (single quote) converted as '

• < (less than) converted as &lt;

• > (greater than) converted as &gt;

There is a string function htmlspecialchars_decode() that reverses the htmlspecialchars() method. The primary function of htmlspecialchars_decode() is to convert special HTML entities back to characters. The functions htmlspecialchars() and htmlspecialchars_decode() are inversely related.

Syntax

Below is the syntax of the PHP String htmlspecialchars() function −

string htmlspecialchars ( string $string [, int $flags [, string $encoding [, bool $double_encode ]]] )

Parameters

Here are the parameters of the htmlspecialchars() function −

• $string − It contains the information about input string.

• $flags − It contains the information about flags.

• $encoding − It is an optional argument defining the encoding used when converting characters.

• $double_encode − When double_encode is disabled, PHP does not encode existing HTML entities; the default is to convert everything.

Return Value

The htmlspecialchars() function returns the converted string. If the input string contains an invalid code unit sequence within the specified encoding, an empty string will be returned, unless the ENT_IGNORE or ENT_SUBSTITUTE flags are set.

PHP Version

First introduced in core PHP 4, the htmlspecialchars() function continues to function easily in PHP 5, PHP 7, and PHP 8.

Example 1

First we will show you the basic example of the PHP String htmlspecialchars() function to convert special characters to HTML entities.

<?php
   // Use htmlspecialchars function here
   $new = htmlspecialchars("<a href='test'>Test</a>", ENT_QUOTES);

   // Print the result here
   echo $new;
?>

Output

Here is the outcome of the following code −

& lt;a href=& #039;test& #039;& gt;Test& lt;/a& gt;

Example 2

In the below PHP code we will use the htmlspecialchars() function and converts special characters in a string into HTML entities.

<?php
   $input = htmlspecialchars("<a href='tutorialspoint'>Tutorialspoint</a>", ENT_QUOTES);
      
   echo $input;
?> 

Output

This will generate the below output −

& lt;a href='tutorialspoint'& gt;Tutorialspoint& lt;/a& gt;

Example 3

Now in the below code, the <script> tags are transformed to plain text, so the browser does not execute the script.

<?php
   $userInput = "<script>alert('Hacked!');</script>";
   $safeInput = htmlspecialchars($userInput, ENT_QUOTES);
   echo "User input: " . $safeInput;
?> 

Output

This will create the below output −

User input: & lt;script& gt;alert(& #039;Hacked!& #039;);& lt;/script& gt;

Note: Please keep in mind that this function only provides the specified translations. The htmlentities() provides comprehensive entity translation.