htmlspecialchars_decode()

The htmlspecialchars_decode() function does the reverse of htmlspecialchars(): it converts the five special HTML entities (&, <, >, ", ') back into their literal characters (&, <, >, ", ').

You typically need it when a string has already been encoded for safe HTML display and you want the raw characters again — for example, to store the original text, to compare against unescaped input, or to feed it to a system that expects literal markup.

This page covers the syntax, the $flags argument and its effect on quotes, the difference from html_entity_decode(), and a security caveat you should know before using it.

Syntax

htmlspecialchars_decode(string $string, int $flags = ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401): string

The function returns the decoded string. Only the entities produced by htmlspecialchars() are converted — for the full set of named and numeric HTML entities, use html_entity_decode() instead.

Note: the default value of $flags changed in PHP 8.1 from ENT_COMPAT | ENT_HTML401 to ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401. The examples below behave identically on both.

Basic example

Example of PHP htmlspecialchars_decode()

In this example, we have a string variable $html_string containing some HTML code with entities. We use the htmlspecialchars_decode() function to convert the HTML entities to their corresponding characters.

The output of this code will be:

<h1>Hello World</h1>

The < and > characters were restored from < and >.

Controlling quotes with $flags

The second argument, $flags, decides which quote entities are decoded. These are the values you will reach for most often:

A common point of confusion: ENT_COMPAT is the name often associated with "double quotes only," but that distinction only applies to the encoding side (htmlspecialchars()). When decoding, ' is converted under both ENT_QUOTES and ENT_COMPAT. To keep single quotes encoded, you must pass ENT_NOQUOTES.

How to use PHP htmlspecialchars_decode()?

In this example, we have a string variable $html_string containing some HTML code with entities, including an encoded single quote. We use the htmlspecialchars_decode() function with the ENT_QUOTES flag to convert the HTML entities to their corresponding characters, and to handle the single quote.

The output of this code will be:

<p>I'm a paragraph</p>

The ENT_QUOTES flag restored the single quote in I'm along with the angle brackets.

htmlspecialchars_decode() vs html_entity_decode()

Both functions turn entities back into characters, but they handle different sets:

• htmlspecialchars_decode() decodes only the five entities created by htmlspecialchars(): &, <, >, " and '. It is fast and predictable.
• html_entity_decode() decodes the entire HTML entity table, including named entities such as ©,  , and €, as well as numeric references.

<?php
$text = "&copy; 2024 &amp; &lt;Acme&gt;";

// Leaves &copy; untouched — it is not one of the five special chars
echo htmlspecialchars_decode($text);   // &copy; 2024 & <Acme>
echo "\n";

// Decodes &copy; too
echo html_entity_decode($text);        // © 2024 & <Acme>
?>

Use htmlspecialchars_decode() when you only need to reverse a call to htmlspecialchars(). Reach for html_entity_decode() when the text may contain named entities like © or  .

Security caveat

Decoding turns <script> back into a live <script> tag. Never decode a string and then print it into an HTML page without re-escaping, or you reopen a cross-site scripting (XSS) hole. Decode for storage, comparison, or non-HTML output — and call htmlspecialchars() again before sending anything back to the browser.

Related functions

• htmlspecialchars() — the encoding counterpart of this function.
• html_entity_decode() — decodes all HTML entities, not just the five special ones.
• htmlentities() — encodes all applicable characters to entities.
• strip_tags() — removes HTML tags entirely instead of decoding them.

Practice