PHP htmlspecialchars()
Function
Example
Convert the predefined characters "<" (less than) and ">" (greater than) to HTML entities:
<?php
$str = "This is some <b>bold</b> text.";
echo htmlspecialchars($str);
?>
The HTML output of the above code is as follows (view source):
<!DOCTYPE html>
<html>
<body>
This is some <b>bold</b> text.
</body>
</html>
The browser output of the above code is as follows:
This is some <b>bold</b> text.
Definition and Usage
The htmlspecialchars()
function converts some predefined characters to HTML entities.
The predefined characters are:
- & (ampersand) becomes &
- " (double quote) becomes "
- ' (single quote) becomes '
- < (less than) becomes <
- > (greater than) becomes >
Tip: To convert special HTML entities back to characters, use the htmlspecialchars_decode() function.
Syntax
Parameter | Description |
---|---|
string | Required. Specifies the string to be converted. |
flags | Optional. Specifies how to handle quotes, invalid encoding, and which document type to use. Available quote types: ENT_COMPAT - Default. Encodes double quotes only.<br>ENT_QUOTES - Encodes both double and single quotes.<br>ENT_NOQUOTES - Does not encode any quotes. Invalid encoding: ENT_IGNORE - Ignores invalid encoding instead of letting the function return an empty string. Should be avoided as it may have security implications.<br>ENT_SUBSTITUTE - Replaces invalid encoding with a specified Unicode replacement character U+FFFD (UTF-8) or FFFD; instead of returning an empty string.<br>ENT_DISALLOWED - Replaces invalid code points in the specified document type with Unicode replacement character U+FFFD (UTF-8) or FFFD;. Additional flags for document type: ENT_HTML401 - Default. Handles code as HTML 4.01.<br>ENT_HTML5 - Handles code as HTML 5.<br>ENT_XML1 - Handles code as XML 1.<br>ENT_XHTML - Handles code as XHTML. |
character-set | Optional. A string that specifies the character set to be used. Allowed values: UTF-8 - Default. ASCII-compatible multi-byte 8-bit Unicode<br>ISO-8859-1 - Western European<br>ISO-8859-15 - Western European (with euro sign + French and Finnish letters missing in ISO-8859-1)<br>cp866 - DOS-specific Cyrillic charset<br>cp1251 - Windows-specific Cyrillic charset<br>cp1252 - Windows-specific Western European charset<br>KOI8-R - Russian<br>BIG5 - Traditional Chinese, mainly used in Taiwan<br>GB2312 - Simplified Chinese, national standard character set<br>BIG5-HKSCS - Big5 with Hong Kong extensions<br>Shift_JIS - Japanese<br>EUC-JP - Japanese<br>MacRoman - Character set used by Mac OS Note: In versions prior to PHP 5.4, unrecognized charsets were replaced with ISO-8859-1. Since PHP 5.4, unrecognized charsets are replaced with UTF-8. |
double_encode | Optional. A boolean value that specifies whether to encode existing HTML entities. TRUE - Default. Encodes every entity.<br>FALSE - Does not encode existing HTML entities. |
Technical Details
Return Value: | Returns the converted string.<br><br>If the string contains invalid encoding, it returns an empty string unless the ENT_IGNORE or ENT_SUBSTITUTE flag is set. |
---|---|
PHP Version: | 4+ |
--- | --- |
Changelog: In PHP 5, the default value for the character-set parameter was changed to UTF-8. In PHP 5.4, new flags were added: ENT_SUBSTITUTE, ENT_DISALLOWED, ENT_HTML401, ENT_HTML5, ENT_XML1, and ENT_XHTML. In PHP 5.3, ENT_IGNORE was added. In PHP 5.2.3, the double_encode parameter was added. In PHP 4.1, the character-set parameter was added.
More Examples
Example 1
Convert some predefined characters to HTML entities:
<?php
$str = "Jane & 'Tarzan'";
echo htmlspecialchars($str, ENT_COMPAT); // Encodes double quotes only
echo "<br>";
echo htmlspecialchars($str, ENT_QUOTES); // Encodes both double and single quotes
echo "<br>";
echo htmlspecialchars($str, ENT_NOQUOTES); // Does not encode any quotes
?>
The HTML output of the above code (view source) is:
<!DOCTYPE html>
<html>
<body>
Jane & 'Tarzan'<br>
Jane & 'Tarzan'<br>
Jane & 'Tarzan'
</body>
</html>
The browser output of the above code is:
Jane & 'Tarzan'
Jane & 'Tarzan'
Jane & 'Tarzan'
Example 2
Convert double quotes to HTML entities:
<?php
$str = 'I love "PHP".';
echo htmlspecialchars($str, ENT_QUOTES); // Encodes both double and single quotes
?>
The HTML output of the above code (view source) is:
<!DOCTYPE html>
<html>
<body>
I love "PHP".
</body>
</html>
The browser output of the above code is:
I love "PHP".