PHP htmlspecialchars() Function — PHP

Example

Convert the predefined characters "<" (less than) and ">" (greater than) to HTML entities:

html

 <?php
$str = "This is some <b>bold</b> text.";
echo htmlspecialchars($str);

 ?>

The HTML output of the code above will be (View Source):

html

 <!DOCTYPE html>
<html>

<body>

 This is some &lt;b&gt;bold&lt;/b&gt; text.

</body>

</html>

The browser output of the code above will be:

html

This is some <b>bold</b> text.

Definition and Usage

The htmlspecialchars() function converts some predefined characters to HTML entities.

The predefined characters are:

& (ampersand) becomes &
" (double quote) becomes "
' (single quote) becomes '
< (less than) becomes <
(greater than) becomes >

Tip: To convert special HTML entities back to characters, use the htmlspecialchars_decode() function.

Syntax

text

htmlspecialchars(string,flags,encoding,double_encode)

Parameter Values

Parameter	Description
string	Required. Specifies the string to convert
flags	Optional. Specifies how to handle quotes, invalid encoding and the used document type. The available quote styles are: ENT_COMPAT - Encodes only double quotes ENT_QUOTES - Default. Encodes double and single quotes ENT_NOQUOTES - Does not encode any quotes Invalid encoding: ENT_IGNORE - Ignores invalid encoding instead of having the function return an empty string. Should be avoided, as it may have security implications. ENT_SUBSTITUTE - Replaces invalid encoding for a specified character set with a Unicode Replacement Character U+FFFD (UTF-8) or &#FFFD; instead of returning an empty string. ENT_DISALLOWED - Replaces code points that are invalid in the specified doctype with a Unicode Replacement Character U+FFFD (UTF-8) or &#FFFD; Additional flags for specifying the used doctype: ENT_HTML401 - Default. Handle code as HTML 4.01 ENT_HTML5 - Handle code as HTML 5 ENT_XML1 - Handle code as XML 1 ENT_XHTML - Handle code as XHTML
encoding	Optional. A string that specifies which character-set to use. Allowed values are: UTF-8 - Default. ASCII compatible multi-byte 8-bit Unicode ISO-8859-1 - Western European ISO-8859-15 - Western European (adds the Euro sign + French and Finnish letters missing in ISO-8859-1) cp866 - DOS-specific Cyrillic charset cp1251 - Windows-specific Cyrillic charset cp1252 - Windows specific charset for Western European KOI8-R - Russian BIG5 - Traditional Chinese, mainly used in Taiwan GB2312 - Simplified Chinese, national standard character set BIG5-HKSCS - Big5 with Hong Kong extensions Shift_JIS - Japanese EUC-JP - Japanese MacRoman - Character-set that was used by Mac OS
double_encode	Optional. A boolean value that specifies whether to encode existing html entities or not. TRUE - Default. Will convert everything FALSE - Will not encode existing html entities

Technical Details

Return Value:	Returns the converted stringIf the string contains invalid encoding, it will return an empty string, unless either the ENT_IGNORE or ENT_SUBSTITUTE flags are set
PHP Version:	4+

More Examples

Example

Convert some predefined characters to HTML entities:

html

 <?php

$str = "Jane & 'Tarzan'";

echo htmlspecialchars($str, ENT_COMPAT); // Will only convert double quotes

echo "<br>";

echo htmlspecialchars($str, ENT_QUOTES); // Converts double and single quotes

echo "<br>";

echo htmlspecialchars($str, ENT_NOQUOTES); // Does not convert any quotes

 ?>

The HTML output of the code above will be (View Source):

html

 <!DOCTYPE html>
<html>

<body>

Jane &amp; 'Tarzan'<br>

Jane &amp; &#039;Tarzan&#039;<br>

Jane &amp; 'Tarzan'

</body>

</html>

The browser output of the code above will be:

html

Jane & 'Tarzan'

Jane & 'Tarzan'

Jane & 'Tarzan'

Example

Convert double quotes to HTML entities:

html

 <?php

 $str = 'I love "PHP".';
echo htmlspecialchars($str, ENT_QUOTES); // Converts double and single quotes

 ?>

The HTML output of the code above will be (View Source):

html

 <!DOCTYPE html>
<html>

<body>

 I love &quot;PHP&quot;.

</body>

</html>

The browser output of the code above will be:

html

I love "PHP".

Example

Convert the predefined characters "<" (less than) and ">" (greater than) to HTML entities:

html

 <?php
$str = "This is some <b>bold</b> text.";
echo htmlspecialchars($str);

 ?>

The HTML output of the code above will be (View Source):

html

 <!DOCTYPE html>
<html>

<body>

 This is some &lt;b&gt;bold&lt;/b&gt; text.

</body>

</html>

The browser output of the code above will be:

html

This is some <b>bold</b> text.

Definition and Usage

The htmlspecialchars() function converts some predefined characters to HTML entities.

The predefined characters are:

& (ampersand) becomes &
" (double quote) becomes "
' (single quote) becomes '
< (less than) becomes <
(greater than) becomes >

Tip: To convert special HTML entities back to characters, use the htmlspecialchars_decode() function.

Syntax

text

htmlspecialchars(string,flags,encoding,double_encode)

Parameter Values

Parameter	Description
string	Required. Specifies the string to convert
flags	Optional. Specifies how to handle quotes, invalid encoding and the used document type. The available quote styles are: ENT_COMPAT - Encodes only double quotes ENT_QUOTES - Default. Encodes double and single quotes ENT_NOQUOTES - Does not encode any quotes Invalid encoding: ENT_IGNORE - Ignores invalid encoding instead of having the function return an empty string. Should be avoided, as it may have security implications. ENT_SUBSTITUTE - Replaces invalid encoding for a specified character set with a Unicode Replacement Character U+FFFD (UTF-8) or &#FFFD; instead of returning an empty string. ENT_DISALLOWED - Replaces code points that are invalid in the specified doctype with a Unicode Replacement Character U+FFFD (UTF-8) or &#FFFD; Additional flags for specifying the used doctype: ENT_HTML401 - Default. Handle code as HTML 4.01 ENT_HTML5 - Handle code as HTML 5 ENT_XML1 - Handle code as XML 1 ENT_XHTML - Handle code as XHTML
encoding	Optional. A string that specifies which character-set to use. Allowed values are: UTF-8 - Default. ASCII compatible multi-byte 8-bit Unicode ISO-8859-1 - Western European ISO-8859-15 - Western European (adds the Euro sign + French and Finnish letters missing in ISO-8859-1) cp866 - DOS-specific Cyrillic charset cp1251 - Windows-specific Cyrillic charset cp1252 - Windows specific charset for Western European KOI8-R - Russian BIG5 - Traditional Chinese, mainly used in Taiwan GB2312 - Simplified Chinese, national standard character set BIG5-HKSCS - Big5 with Hong Kong extensions Shift_JIS - Japanese EUC-JP - Japanese MacRoman - Character-set that was used by Mac OS
double_encode	Optional. A boolean value that specifies whether to encode existing html entities or not. TRUE - Default. Will convert everything FALSE - Will not encode existing html entities

Technical Details

Return Value:	Returns the converted stringIf the string contains invalid encoding, it will return an empty string, unless either the ENT_IGNORE or ENT_SUBSTITUTE flags are set
PHP Version:	4+

More Examples

Example

Convert some predefined characters to HTML entities:

html

 <?php

$str = "Jane & 'Tarzan'";

echo htmlspecialchars($str, ENT_COMPAT); // Will only convert double quotes

echo "<br>";

echo htmlspecialchars($str, ENT_QUOTES); // Converts double and single quotes

echo "<br>";

echo htmlspecialchars($str, ENT_NOQUOTES); // Does not convert any quotes

 ?>

The HTML output of the code above will be (View Source):

html

 <!DOCTYPE html>
<html>

<body>

Jane &amp; 'Tarzan'<br>

Jane &amp; &#039;Tarzan&#039;<br>

Jane &amp; 'Tarzan'

</body>

</html>

The browser output of the code above will be:

html

Jane & 'Tarzan'

Jane & 'Tarzan'

Jane & 'Tarzan'

Example

Convert double quotes to HTML entities:

html

 <?php

 $str = 'I love "PHP".';
echo htmlspecialchars($str, ENT_QUOTES); // Converts double and single quotes

 ?>

The HTML output of the code above will be (View Source):

html

 <!DOCTYPE html>
<html>

<body>

 I love &quot;PHP&quot;.

</body>

</html>

The browser output of the code above will be:

html

I love "PHP".