PHP htmlspecialchars_decode() Function

What You’ll Learn

The htmlspecialchars_decode() function reverses htmlspecialchars(), turning entities like < and & back into < and &. It decodes only the special character subset—not every HTML entity.

Definition and Usage

In PHP, htmlspecialchars_decode() is the decoding counterpart of htmlspecialchars(). It converts these entities back to characters: &, <, >, and quote entities (depending on flags). Named symbols like © are not decoded—use html_entity_decode() for those.

📝 Syntax

The function accepts a string and optional flags (no encoding parameter):

string htmlspecialchars_decode(
    string $string,
    int $flags = ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401
)

Parameters

• $string — the input string containing special HTML entities to decode.
• $flags — bitmask controlling quote decoding and document type: ENT_COMPAT, ENT_QUOTES, ENT_NOQUOTES, ENT_HTML401, ENT_HTML5, etc.

Return Value

Returns the decoded string with special entities converted back to characters.

Examples Gallery

Run these examples in PHP 5.1+. Each demonstrates a common pattern beginners encounter with htmlspecialchars_decode().

<?php
$htmlString = "&lt;p&gt;This is a &lt;b&gt;bold&lt;/b&gt; paragraph.&lt;/p&gt;";
$decoded    = htmlspecialchars_decode($htmlString, ENT_QUOTES);

echo "Encoded: $htmlString\n";
echo "Decoded: $decoded\n";
?>

Encoded: <p>This is a <b>bold</b> paragraph.</p>
Decoded: <p>This is a <b>bold</b> paragraph.</p>

<?php
$original = 'Say "Hello" & <welcome>';
$encoded  = htmlspecialchars($original, ENT_QUOTES, 'UTF-8');
$decoded  = htmlspecialchars_decode($encoded, ENT_QUOTES);

echo "Encoded: $encoded\n";
echo "Decoded: $decoded\n";
echo "Match:   " . ($original === $decoded ? "yes\n" : "no\n");
?>

Encoded: Say "Hello" & <welcome>
Decoded: Say "Hello" & <welcome>
Match:   yes

<?php
$encoded = "Tom &amp; Jerry &copy; 2026";

$special = htmlspecialchars_decode($encoded, ENT_QUOTES);
$full    = html_entity_decode($encoded, ENT_QUOTES, 'UTF-8');

echo "htmlspecialchars_decode: $special\n";
echo "html_entity_decode:      $full\n";
?>

htmlspecialchars_decode: Tom & Jerry © 2026
html_entity_decode:      Tom & Jerry © 2026

<?php
$str = "&lt;p&gt;this -&gt; &quot;hi&quot;&lt;/p&gt;";

echo htmlspecialchars_decode($str, ENT_QUOTES) . "\n";
echo htmlspecialchars_decode($str, ENT_NOQUOTES) . "\n";
?>

<p>this -> "hi"</p>
<p>this -> &quot;hi&quot;</p>

<?php
$stored = "&lt;em&gt;Hello&lt;/em&gt; &amp; welcome";

// Process as plain text (search, trim, etc.)
$plain = htmlspecialchars_decode($stored, ENT_QUOTES);
$clean = strip_tags($plain);

// Safe for HTML output
$safeHtml = htmlspecialchars($clean, ENT_QUOTES, 'UTF-8');

echo "Plain: $plain\n";
echo "Clean: $clean\n";
echo "Safe:  $safeHtml\n";
?>

Plain: <em>Hello</em> & welcome
Clean: Hello & welcome
Safe:  Hello &amp; welcome

🚀 Common Use Cases

• Reverse htmlspecialchars storage — decode text that was escaped before saving to a database.
• Form editing — show escaped values as readable text in admin or edit screens (then re-escape on save/display).
• Search indexing — convert escaped snippets to plain characters for matching.
• Debugging — inspect what htmlspecialchars() produced by reversing it.
• API responses — decode escaped fields when the consumer expects plain text, not HTML entities.

📝 Notes

• Inverse of htmlspecialchars(), not htmlentities() (use html_entity_decode() for that).
• No $encoding parameter—only string and flags (unlike the encode function).
• Default flags changed in PHP 8.1 to ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401.
• Does not decode named symbol entities such as © or €.
• Decoding untrusted input and echoing raw HTML can reintroduce XSS vulnerabilities.

💡 Best Practices