nl2br()

The PHP nl2br() function inserts an HTML line break (<br /> or <br>) before each newline character (\n, \r\n, \r, or \n\r) in a string. It is one of the most common functions in PHP web development, because newlines in plain text — the ones a user types with the Enter key, or that come back from a database — are invisible in HTML. Browsers collapse whitespace, so a multi-line message rendered straight into a page comes out as a single run-on line. nl2br() bridges that gap by turning each line break into markup the browser actually honors.

This chapter covers the syntax, the $is_xhtml parameter, what nl2br() does (and does not) change, the typical use case with user input, and the security gotcha you must not skip.

Syntax

nl2br(string $string, bool $use_xhtml = true): string

The function returns a new string with the breaks inserted; PHP strings are immutable, so the original $string is left untouched.

Basic example

Output (the raw HTML the browser receives):

Hello<br />
World!

Notice that the original \n is still there — nl2br() adds the <br /> before the newline, it does not replace it. That is intentional: it keeps the source readable when you view the page source, while the <br /> is what forces the visible line break.

Controlling the tag style with $use_xhtml

Pass false as the second argument to get HTML5-style <br> tags instead of the self-closing XHTML form:

<?php
echo nl2br("Line 1\nLine 2", false);
?>

Output:

Line 1<br>
Line 2

Use <br /> (the default) for XHTML or XML documents; either form is valid in HTML5, so the default works almost everywhere.

The real use case: user input

The function shines when you echo text a user submitted in a <textarea>. Browsers ignore the newlines a user typed, so without nl2br() a multi-paragraph comment renders as one block. But there is a critical ordering rule: escape first, then break. If you run nl2br() on raw input you protect line breaks but leave the door open to XSS, because nl2br() does not escape HTML — it only adds <br> tags.

<?php
$comment = "Hi there\nThanks for the great post!";

// Correct order: escape the HTML, THEN convert newlines.
echo nl2br(htmlspecialchars($comment));
?>

htmlspecialchars() neutralizes any <, >, or & the user typed, and nl2br() then adds safe <br /> tags afterward. Reversing the order — htmlspecialchars(nl2br($comment)) — would escape your own <br /> tags into visible <br> text, so the breaks would never render.

Common gotchas

• It does not remove or replace the newline. The \n stays in the string. If you need the line break gone, run str_replace() afterward.
• It is not a security function. nl2br() performs no escaping. Always pair it with htmlspecialchars() on untrusted input.
• It only acts on newline characters, not on <textarea> wrapping or word-wrap — those are visual-only and never reach your script.
• Plain text only. Sending its output as an email body or writing it to a CSV is pointless; the <br> tags are HTML and mean nothing outside a browser.

Related functions

• htmlspecialchars() — escape special characters before output (use it together with nl2br()).
• str_replace() — replace substrings, e.g. to strip newlines entirely.
• strip-tags() — remove HTML tags from a string.
• trim() — strip leading and trailing whitespace, including stray newlines.

Practice