htmlspecialchars()

The htmlspecialchars() function converts the handful of characters that have a special meaning in HTML into their corresponding HTML entities. Its main job is safety: when you echo user-supplied data into a web page, passing it through htmlspecialchars() first prevents that data from being interpreted as markup or script — the standard defense against cross-site scripting (XSS) attacks.

This page covers the function's syntax, each of its parameters with runnable examples, the five characters it affects, how it differs from related functions, and how to safely reverse it.

Syntax

htmlspecialchars(
    string $string,
    int $flags = ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401,
    ?string $encoding = null,
    bool $double_encode = true
): string

The function takes one required parameter, $string — the string to convert — and three optional parameters: $flags, $encoding, and $double_encode. It returns the converted string.

Note on the default flag. As of PHP 8.1 the default value of $flags is ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401, which encodes both single and double quotes. In PHP 8.0 and earlier the default was ENT_COMPAT, which left single quotes untouched. If you support older versions, always pass ENT_QUOTES explicitly so behavior is predictable.

Which characters are converted

Only five characters are affected. Everything else passes through unchanged:

If you also need to encode accented letters, symbols, and other non-ASCII characters, use htmlentities() instead.

Basic example

Output:

Hello <strong>World</strong>!

The <strong> tags have been converted to <strong> and </strong>. When this string is sent to a browser it now displays the literal text <strong>World</strong> instead of rendering bold markup.

The $flags parameter: handling quotes

The second parameter, $flags, specifies how to handle quotes and which document type to use. The most common choice is ENT_QUOTES, which converts both single (') and double (") quotes. This matters whenever you place a value inside an HTML attribute, because an unescaped quote could close the attribute early and inject new ones.

Output:

I'm a paragraph

The single quote was converted to '. The common flag values are:

• ENT_QUOTES — converts both double and single quotes (recommended).
• ENT_COMPAT — converts double quotes, leaves single quotes alone.
• ENT_NOQUOTES — leaves both kinds of quotes unconverted.
• ENT_SUBSTITUTE — replaces invalid code-unit sequences with � instead of returning an empty string.

The $encoding parameter

The third parameter, $encoding, names the character encoding of the input string. It defaults to the value of the default_charset INI setting (UTF-8 on modern installs). Setting it explicitly avoids surprises if your input is in a different encoding.

Output:

Tom & Jerry

Here the ampersand is encoded as & while PHP interprets the input as UTF-8. If the encoding does not match the actual bytes of $string, the function may return an empty string (or a substitution character when ENT_SUBSTITUTE is set).

The $double_encode parameter

The fourth parameter, $double_encode, controls whether existing entities are encoded again. By default it is true, so a string that already contains < becomes <. Set it to false to leave already-encoded entities intact — useful when the input has been partially escaped already.

Output:

Hello <strong>World</strong>!

The existing < and > entities are left unchanged because $double_encode is false. With the default true, the same input would have produced Hello <strong>....

Preventing XSS in practice

The most important use of htmlspecialchars() is escaping any data you do not fully control — form input, query-string values, database records that originated from users — before printing it into a page:

<?php
$comment = $_GET['comment'] ?? '';   // e.g. "<script>alert('xss')</script>"
echo "<p>" . htmlspecialchars($comment, ENT_QUOTES, "UTF-8") . "</p>";
?>

The <script> tag is neutralized into <script>...</script>, so the browser shows the text instead of executing it. Apply the escaping at the moment of output, not when storing the data, so the raw value stays available for other contexts.

Reversing the conversion

To turn the entities back into their original characters, use htmlspecialchars_decode(). Pass the same flags you used when encoding so quotes are handled symmetrically.

Related functions

• htmlentities() — like htmlspecialchars() but converts all characters that have HTML entity equivalents, not just the five special ones.
• htmlspecialchars_decode() — the inverse of this function.
• strip_tags() — removes HTML and PHP tags entirely instead of escaping them.
• nl2br() — inserts <br> before newlines, often used after escaping plain text.

Summary

Use htmlspecialchars() whenever you output untrusted text into HTML. Pass ENT_QUOTES and an explicit UTF-8 encoding for predictable, secure results across PHP versions, escape at output time, and reach for htmlentities() only when you need to encode every entity rather than just the five special characters.

Practice