htmlspecialchars()

Also Known As

TL;DR

Explanation

htmlspecialchars($string, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') converts <, >, &, ", and ' to their HTML entity equivalents, preventing injected text from being interpreted as HTML or JavaScript. ENT_QUOTES encodes both single and double quotes. ENT_SUBSTITUTE (PHP 8.1+) replaces invalid UTF-8 sequences with a replacement character instead of returning an empty string. Always specify the charset explicitly. This function is for HTML body and attribute contexts only — different escaping is needed for JavaScript, CSS, and URLs.

Common Misconception

Why It Matters

Common Mistakes

• Forgetting the ENT_QUOTES flag — without it, single quotes are not escaped, enabling injection in single-quoted attributes.
• Not specifying the charset — defaults to latin-1 in older PHP, which can be bypassed with multi-byte characters.
• Using htmlspecialchars() in non-HTML contexts (JavaScript, CSS, URLs) — each context requires different escaping.
• Using strip_tags() instead — it removes tags but attribute-based XSS (onerror=) survives in allowed tags.

Code Examples

echo '<p>' . $userInput . '</p>'; // XSS if input contains <script>

// Always specify ENT_QUOTES and charset
echo '<p>' . htmlspecialchars($userInput, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') . '</p>';

// Helper function — use everywhere user data touches HTML
function e(string $s): string {
    return htmlspecialchars($s, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
}

echo '<input value="' . e($_GET['q']) . '">';  // safe
echo '<a href="' . e($url) . '">' . e($label) . '</a>'; // safe

// htmlspecialchars_decode() reverses it — use only for internal data, never user input

References

• ↗ https://www.php.net/manual/en/function.htmlspecialchars.php

Tags

Related Terms