htmlspecialchars() function in PHP

The htmlspecialchars() function is used to convert special characters to HTML entities.
The predefined characters are −
& (ampersand) becomes & amp;
" (double quote) becomes & quot;
' (single quote) becomes & #039;
< (less than) becomes & lt;
> (greater than) becomes & gt;
htmlspecialchars(str,flags,character-set,double_encode)
str  − The string to convert.
str  − The string to convert.
flags  −How to handle quotes, invalid encoding and the used document type.
flags  −How to handle quotes, invalid encoding and the used document type.
The following are the available quote styles −ENT_COMPAT  − Default. Encodes only double quotesENT_QUOTES  − Encodes double and single quotesENT_NOQUOTES  − Does not encode any quotes
The following are the available quote styles −
ENT_COMPAT  − Default. Encodes only double quotes
ENT_COMPAT  − Default. Encodes only double quotes
ENT_QUOTES  − Encodes double and single quotes
ENT_QUOTES  − Encodes double and single quotes
ENT_NOQUOTES  − Does not encode any quotes
ENT_NOQUOTES  − Does not encode any quotes
Invalid encoding −ENT_IGNORE  − Ignores invalid encoding instead of having the function return an empty string. Should be avoided, as it may have security implications.ENT_SUBSTITUTE  − Replaces invalid encoding for a specified character set with a Unicode Replacement Character U+FFFD (UTF-8) or &#FFFD; instead of returning an empty string.ENT_DISALLOWED  − Replaces code points that are invalid in the specified doctype with a Unicode Replacement Character U+FFFD (UTF-8) or &#FFFD;
Invalid encoding −
ENT_IGNORE  − Ignores invalid encoding instead of having the function return an empty string. Should be avoided, as it may have security implications.
ENT_IGNORE  − Ignores invalid encoding instead of having the function return an empty string. Should be avoided, as it may have security implications.
ENT_SUBSTITUTE  − Replaces invalid encoding for a specified character set with a Unicode Replacement Character U+FFFD (UTF-8) or &#FFFD; instead of returning an empty string.
ENT_SUBSTITUTE  − Replaces invalid encoding for a specified character set with a Unicode Replacement Character U+FFFD (UTF-8) or &#FFFD; instead of returning an empty string.
ENT_DISALLOWED  − Replaces code points that are invalid in the specified doctype with a Unicode Replacement Character U+FFFD (UTF-8) or &#FFFD;
ENT_DISALLOWED  − Replaces code points that are invalid in the specified doctype with a Unicode Replacement Character U+FFFD (UTF-8) or &#FFFD;
The following are the additional flags for specifying the used doctype −ENT_HTML401  − Default. Handle code as HTML 4.01ENT_HTML5  − Handle code as HTML 5ENT_XML1  − Handle code as XML 1ENT_XHTML  − Handle code as XHTML
The following are the additional flags for specifying the used doctype −
ENT_HTML401  − Default. Handle code as HTML 4.01
ENT_HTML401  − Default. Handle code as HTML 4.01
ENT_HTML5  − Handle code as HTML 5
ENT_HTML5  − Handle code as HTML 5
ENT_XML1  − Handle code as XML 1
ENT_XML1  − Handle code as XML 1
ENT_XHTML  − Handle code as XHTML
ENT_XHTML  − Handle code as XHTML
character-set − The character-set to use
character-set − The character-set to use
The following are the allowed values are −UTF-8  − Default. ASCII compatible multi-byte 8-bit UnicodeISO-8859-1  − Western EuropeanISO-8859-15  − Western European (adds the Euro sign + French and Finnish letters missing in ISO-8859-1)cp866  − DOS-specific Cyrillic charsetcp1251  − Windows-specific Cyrillic charsetcp1252  − Windows specific charset for Western EuropeanKOI8-R  − RussianBIG5  − Traditional Chinese, mainly used in TaiwanGB2312  − Simplified Chinese, national standard character setBIG5-HKSCS  − Big5 with Hong Kong extensionsShift_JIS  − JapaneseEUC-JP  − JapaneseMacRoman  − Character-set that was used by Mac OS
The following are the allowed values are −
UTF-8  − Default. ASCII compatible multi-byte 8-bit Unicode
UTF-8  − Default. ASCII compatible multi-byte 8-bit Unicode
ISO-8859-1  − Western European
ISO-8859-1  − Western European
ISO-8859-15  − Western European (adds the Euro sign + French and Finnish letters missing in ISO-8859-1)
ISO-8859-15  − Western European (adds the Euro sign + French and Finnish letters missing in ISO-8859-1)
cp866  − DOS-specific Cyrillic charset
cp866  − DOS-specific Cyrillic charset
cp1251  − Windows-specific Cyrillic charset
cp1251  − Windows-specific Cyrillic charset
cp1252  − Windows specific charset for Western European
cp1252  − Windows specific charset for Western European
KOI8-R  − Russian
KOI8-R  − Russian
BIG5  − Traditional Chinese, mainly used in Taiwan
BIG5  − Traditional Chinese, mainly used in Taiwan
GB2312  − Simplified Chinese, national standard character set
GB2312  − Simplified Chinese, national standard character set
BIG5-HKSCS  − Big5 with Hong Kong extensions
BIG5-HKSCS  − Big5 with Hong Kong extensions
Shift_JIS  − Japanese
Shift_JIS  − Japanese
EUC-JP  − Japanese
EUC-JP  − Japanese
MacRoman  − Character-set that was used by Mac OS
MacRoman  − Character-set that was used by Mac OS
double_encode − A boolean value that specifies whether to encode existing html entities or not.TRUE  − Default. Will convert everythingFALSE  − Will not encode existing html entities
double_encode − A boolean value that specifies whether to encode existing html entities or not.
TRUE  − Default. Will convert everything
TRUE  − Default. Will convert everything
FALSE  − Will not encode existing html entities
FALSE  − Will not encode existing html entities
The htmlspecialchars() function returns the converted string.
The following is an example −
 Live Demo
<?php
$res = htmlspecialchars("<a href='mylink' rel=”nofollow”><strong>Demo</strong></a>", ENT_QUOTES);
echo $res //
?>
& lt;a href=& #039;mylink& #039; rel=”nofollow”& gt;& lt;strong& gt;Demo& lt;/strong& gt;& lt;/a >