The htmlentities() function converts characters into HTML entities—not just & and <, but also symbols like © and many accented letters. It is the encoding counterpart of html_entity_decode().
All entity chars.
Quote & doc type.
Always specify it.
Full vs subset.
Skip re-encoding.
Escape on output.
In PHP, htmlentities() translates every character that has an HTML entity equivalent into that entity string. Unlike htmlspecialchars(), which focuses on a small set of dangerous characters, htmlentities() can encode copyright signs, currency symbols, and accented letters depending on the chosen document type and encoding flags.
For most web page output, htmlspecialchars($text, ENT_QUOTES, 'UTF-8') is enough to prevent XSS. Reach for htmlentities() when you genuinely need the full entity map—for example, encoding © and é as entities in stored HTML-safe text.
The function accepts a string, flags, encoding, and a double-encode option:
string htmlentities(
string $string,
int $flags = ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401,
?string $encoding = null,
bool $double_encode = true
)$string — the input text to encode.$flags — bitmask for quotes and document type: ENT_COMPAT, ENT_QUOTES, ENT_NOQUOTES, ENT_HTML401, ENT_HTML5, ENT_SUBSTITUTE, etc.$encoding — character encoding (strongly recommended: 'UTF-8').$double_encode — when true (default), existing entities like © are encoded again; when false, they are left as-is.Returns the entity-encoded string, or an empty string if the input contains invalid sequences for the encoding (unless ENT_IGNORE or ENT_SUBSTITUTE is set).
htmlentities($s, ENT_QUOTES, 'UTF-8')Full entity map
html_entity_decode($s, ENT_QUOTES, 'UTF-8')Reverse encoding
..., 'UTF-8', false)Keep © as-is
htmlspecialchars($s, ENT_QUOTES, 'UTF-8')Usually enough
Run these examples in PHP 7+. Each demonstrates a common pattern beginners encounter with htmlentities().
Encode angle brackets so HTML tags display as plain text.
Prevent <strong> from being interpreted as real HTML when echoed.
<?php
$text = "Hello, <strong>PHP</strong>!";
$encoded = htmlentities($text, ENT_QUOTES, 'UTF-8');
echo "Original: $text\n";
echo "Encoded: $encoded\n";
?>< becomes < and > becomes >. Browsers render the encoded string as visible text instead of bold formatting.
See how the full encoder handles symbols that the subset encoder leaves unchanged.
<?php
$text = "Tom & Jerry © 2026 — €5";
$special = htmlspecialchars($text, ENT_QUOTES, 'UTF-8');
$full = htmlentities($text, ENT_QUOTES, 'UTF-8');
echo "htmlspecialchars: $special\n";
echo "htmlentities: $full\n";
?>Both encode &. Only htmlentities() converts ©, em dashes, and € into named entities. For XSS prevention alone, the smaller output from htmlspecialchars() is usually sufficient.
Quote encoding, double_encode, and roundtrip decoding.
Use ENT_QUOTES when text may appear inside HTML attributes delimited by single quotes.
<?php
$name = "O'Brien & Co";
$compat = htmlentities($name, ENT_COMPAT, 'UTF-8');
$quotes = htmlentities($name, ENT_QUOTES, 'UTF-8');
echo "ENT_COMPAT: $compat\n";
echo "ENT_QUOTES: $quotes\n";
?>ENT_COMPAT encodes double quotes and & but leaves apostrophes alone. ENT_QUOTES also encodes ', which prevents attribute-breakout when using single-quoted HTML attributes.
Skip re-encoding when the input already contains HTML entities.
<?php
$partial = "Already has © symbol";
$again = htmlentities($partial, ENT_QUOTES, 'UTF-8', true);
$once = htmlentities($partial, ENT_QUOTES, 'UTF-8', false);
echo "double_encode true: $again\n";
echo "double_encode false: $once\n";
?>With default true, the & in © becomes &, producing &copy;. Setting false preserves existing entities while still encoding unencoded characters elsewhere in the string.
Encode for storage or transport, decode when you need the original characters back.
<?php
$original = 'Café & "Tea" <shop>';
$encoded = htmlentities($original, ENT_QUOTES, 'UTF-8');
$decoded = html_entity_decode($encoded, ENT_QUOTES, 'UTF-8');
echo "Encoded: $encoded\n";
echo "Decoded: $decoded\n";
echo "Match: " . ($original === $decoded ? "yes\n" : "no\n");
?>Use matching flags and UTF-8 on both functions. htmlentities() encodes; html_entity_decode() restores the original text for processing or display in non-HTML contexts.
get_html_translation_table(HTML_ENTITIES).htmlentities() WorksInput may contain HTML, quotes, symbols, and UTF-8 characters plus ENT flags and encoding.
Each applicable character is replaced using the translation table from get_html_translation_table(HTML_ENTITIES, ...).
< → <, © → ©, quotes encoded per flags, and so on.
Safe to embed in HTML as text, or store as encoded content.
ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401.'UTF-8' as encoding for modern applications.htmlspecialchars() is usually preferred for output escaping; it encodes fewer characters but covers XSS essentials.ENT_SUBSTITUTE or ENT_IGNORE is set.The htmlentities() function converts characters to HTML entities across the full applicable set—not just the core special characters. Use it when you need comprehensive entity encoding; use htmlspecialchars() for typical output escaping.
Pass ENT_QUOTES and 'UTF-8', understand double_encode, and pair with html_entity_decode() when you need to reverse the process.
ENT_QUOTES and 'UTF-8' explicitlyhtmlspecialchars() for standard HTML output escapinghtml_entity_decode()double_encode to false for partially encoded inputhtmlentities()Use these points whenever you encode HTML entities in PHP.
All entity chars.
PurposeFlags and encoding.
SyntaxFull vs subset.
CompareControl re-encoding.
Optionhtml_entity_decode().
RelatedContinue with htmlspecialchars_decode(), htmlspecialchars(), and the rest of the string function reference.
6 people found this page helpful