htmlentities()

The PHP htmlentities() function converts every character that has a named HTML entity into that entity. It is the main tool for safely printing untrusted text — such as user input from a form — inside an HTML page, because it turns characters that the browser would otherwise interpret as markup (<, >, &, quotes) into harmless visible text. This is what makes it a first line of defense against cross-site scripting (XSS).

This page covers the syntax, each of the four parameters, the practical difference from htmlspecialchars(), and the common gotchas around encoding and double-encoding.

Syntax

htmlentities(
    string $string,
    int $flags = ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401,
    ?string $encoding = null,
    bool $double_encode = true
): string

It returns a new string with the applicable characters converted; the original string is never modified.

Note: As of PHP 8.1 the default flags are ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401. On PHP 8.0 and earlier the default was ENT_COMPAT | ENT_HTML401, which does not encode single quotes. If you support older versions, pass ENT_QUOTES explicitly.

Basic usage

This outputs:

Hello <strong>World</strong>!

The < and > characters are now < and >, so the browser renders them as literal text instead of opening a real <strong> tag.

The $flags parameter — handling quotes

The second parameter controls how quotation marks are treated. The most useful flags are:

Use ENT_QUOTES whenever the output may land inside a single-quoted HTML attribute, otherwise a ' in the data could break out of the attribute.

Output:

I'm a paragraph

The single quote becomes '. With the older ENT_COMPAT default it would have stayed as a literal '.

The $encoding parameter

The third parameter tells htmlentities() which character set the input uses so it can map multibyte characters correctly. Always set this explicitly to "UTF-8" for modern applications — a mismatched encoding can silently corrupt output or, in older PHP versions, return an empty string.

Output:

Café & «über»

Note how é, «, ü, and » each became their named entities — this is the behavior that distinguishes htmlentities() from htmlspecialchars(), which would leave those accented characters untouched.

The $double_encode parameter

By default (true), htmlentities() re-encodes the & in an existing entity, so < becomes <. Pass false to leave already-encoded entities alone — useful when part of your string is intentionally pre-escaped.

With $double_encode set to false, the existing entities pass through unchanged:

Hello <strong>World</strong>!

Had you left $double_encode at its default true, each & would have been re-escaped to &, producing Hello <strong>....

htmlentities() vs htmlspecialchars()

This is the most common point of confusion:

• htmlspecialchars() converts only the five characters that have special meaning in HTML: &, <, >, ", and '.
• htmlentities() converts those plus every other character that has a named entity (accented letters, symbols, currency signs, and so on).

For securely escaping output, htmlspecialchars() is usually the better choice: it is smaller, faster, and — as long as you emit a UTF-8 page — accented characters display correctly on their own without being turned into entities. Reach for htmlentities() only when you specifically need every entity-mappable character converted, for example when generating content for a target whose charset you cannot control.

To reverse the conversion, use html_entity_decode() or htmlspecialchars_decode().

Key points

• htmlentities() returns a new string and never changes the original.
• Always pass ENT_QUOTES and "UTF-8" explicitly for predictable, secure output across PHP versions.
• It is an output filter — escape data when you print it, not when you store it.
• For typical HTML escaping, prefer htmlspecialchars().

Practice