PHP htmlspecialchars() Function

What You’ll Learn

The htmlspecialchars() function is PHP’s primary tool for output escaping. It converts &, <, >, and quotes into HTML entities so user input displays as text instead of running as code.

Definition and Usage

In PHP, htmlspecialchars() prepares dynamic text for safe inclusion in HTML documents. Characters with special meaning in HTML are replaced with entities so browsers render them literally. This is essential whenever you echo user input, database values, or any untrusted string into a web page.

📝 Syntax

The function accepts a string, flags, encoding, and double-encode option:

string htmlspecialchars(
    string $string,
    int $flags = ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401,
    ?string $encoding = null,
    bool $double_encode = true
)

Characters Encoded

• & → &
• < → <
• > → >
• " → " (unless ENT_NOQUOTES)
• ' → ' or similar (when ENT_QUOTES is set)

Parameters

• $string — input text to escape.
• $flags — quote and document-type bitmask. Use ENT_QUOTES for web output.
• $encoding — character encoding (strongly recommended: 'UTF-8').
• $double_encode — when true (default), encodes existing entities again; when false, leaves existing entities unchanged.

Return Value

Returns the escaped string safe for HTML text and attribute contexts (when using ENT_QUOTES).

Examples Gallery

Run these examples in PHP 7+. Each demonstrates a common pattern beginners encounter with htmlspecialchars().

<?php
$userInput = '<script>alert("XSS")</script>';
$safe      = htmlspecialchars($userInput, ENT_QUOTES, 'UTF-8');

echo "Raw:  $userInput\n";
echo "Safe: $safe\n";
?>

Raw:  <script>alert("XSS")</script>
Safe: &lt;script&gt;alert(&quot;XSS&quot;)&lt;/script&gt;

<?php
$input   = "<a href='https://example.com'>Click here</a>";
$escaped = htmlspecialchars($input, ENT_QUOTES, 'UTF-8');

echo $escaped . "\n";
?>

<a href='https://example.com'>Click here</a>

<?php
$text = "Tom & Jerry © 2026 — €5";

$special = htmlspecialchars($text, ENT_QUOTES, 'UTF-8');
$full    = htmlentities($text, ENT_QUOTES, 'UTF-8');

echo "htmlspecialchars: $special\n";
echo "htmlentities:     $full\n";
?>

htmlspecialchars: Tom & Jerry © 2026 — €5
htmlentities:     Tom & Jerry © 2026 — €5

<?php
$name = "O'Brien";

$compat = htmlspecialchars($name, ENT_COMPAT, 'UTF-8');
$quotes = htmlspecialchars($name, ENT_QUOTES, 'UTF-8');

echo "ENT_COMPAT: $compat\n";
echo "ENT_QUOTES: $quotes\n";
?>

ENT_COMPAT: O'Brien
ENT_QUOTES: O'Brien

<?php
$partial = "Already has &copy; symbol";

$again = htmlspecialchars($partial, ENT_QUOTES, 'UTF-8', true);
$once  = htmlspecialchars($partial, ENT_QUOTES, 'UTF-8', false);

echo "double_encode true:  $again\n";
echo "double_encode false: $once\n";
?>

double_encode true:  Already has © symbol
double_encode false: Already has © symbol

🚀 Common Use Cases

• Echoing user input — comments, names, search terms displayed on a page.
• HTML attribute values — escape with ENT_QUOTES for title, value, and data attributes.
• Error and status messages — safely show dynamic feedback without injecting markup.
• Admin dashboards — display stored data that may contain special characters.
• Template rendering — escape variables before inserting into HTML layouts.

📝 Notes

• Default flags changed in PHP 8.1 to ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401.
• Always pass 'UTF-8' explicitly for modern applications.
• Escape at output time—store raw data in the database when possible.
• Not sufficient for JavaScript or CSS contexts—those need context-specific escaping.
• Does not encode ©, €, or accented letters—use htmlentities() if you need full entity encoding.

💡 Best Practices