html_entity_decode()

The PHP html_entity_decode() function converts HTML entities (like <, &, or ©) back into their corresponding characters (<, &, ©). It is the inverse of htmlentities(), and it is what you reach for whenever you need to turn already-encoded HTML back into readable text — for example, when reading data that was stored in encoded form, or when processing the output of a system that escaped its HTML.

This page explains the syntax, each parameter, the flags that control how quotes are handled, and the common pitfalls (especially around security).

Syntax

html_entity_decode(
    string $string,
    int $flags = ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401,
    ?string $encoding = null
): string

The function returns the decoded string. Since PHP 8.1 the default for $flags is ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401; older versions defaulted to ENT_COMPAT | ENT_HTML401.

Basic example

The < and > entities are turned back into < and >, so the output is:

<h1>Hello World</h1>

Controlling quotes with $flags

The $flags parameter decides how single and double quotes are treated:

Add ENT_HTML401, ENT_HTML5, ENT_XML1, or ENT_XHTML to pick the entity set, and ENT_SUBSTITUTE/ENT_IGNORE to control how invalid byte sequences are handled. Use ENT_QUOTES when the input may contain encoded single quotes (' / '):

With ENT_QUOTES, both the tags and the encoded single quote are restored:

<p>I'm a paragraph</p>

Specifying the character encoding

The third parameter, $encoding, tells PHP how to interpret the input bytes. It defaults to your default_charset ini setting. Pass it explicitly when you cannot rely on that default — most often "UTF-8":

ENT_HTML5 lets PHP recognize the full set of named HTML5 entities, so é and & are decoded to:

Café & Co.

Security: do not decode before output

html_entity_decode() is the opposite of escaping. Decoding user-supplied content and then printing it into a page reintroduces any <script> tags or attributes that escaping removed, opening an XSS hole. Decode only when you need the raw characters for non-HTML purposes (logging, comparison, generating a plain-text version, building a PDF, etc.). When you echo into HTML, keep the data escaped.

Related functions

• htmlentities() — the inverse: converts characters into HTML entities.
• htmlspecialchars() — escapes only the five special HTML characters (<, >, &, ", ').
• htmlspecialchars_decode() — reverses htmlspecialchars(); faster than html_entity_decode() when you only need those five characters back.

html_entity_decode() handles the full named-entity set, so use it when the input may contain entities like © or é; reach for htmlspecialchars_decode() when you only ever produced output with htmlspecialchars().

Practice