HTML tags to print on page by htmlspecialchars function

$input = '<strong>Tom & Jerry</strong>';
echo htmlspecialchars($input, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');

Rendered as HTML, the tags in the sample affect presentation:

To show the markup itself as text, escape it before inserting it into the page:

$sample = '<b>Hello this is bold</b> <i>This is italic</i>';
echo htmlspecialchars($sample, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');

The browser then displays the angle brackets instead of interpreting them as HTML.

<b>Hello this is bold</b> <i>This is italic</i>

Characters handled by htmlspecialchars()

By default, htmlspecialchars() converts characters that have special meaning in HTML, including &, <, > and quotes according to the selected flags. For modern UTF-8 pages, explicitly passing ENT_QUOTES | ENT_SUBSTITUTE and 'UTF-8' makes the intended behavior clear.

Example: Escaping User Input for HTML Output

$input = "<script>alert('XSS');</script>";
$escaped_input = htmlspecialchars($input, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
echo $escaped_input; // <script>alert(&#039;XSS&#039;);</script>

Example: Handling Special Characters

$str = 'Hello & welcome!';
echo htmlspecialchars($str);  // Output: Hello & welcome!

Example: Comparing htmlspecialchars() and htmlentities()

$str = '© 2023 Plus2Net';
echo htmlspecialchars($str);  // Output: © 2023 Plus2Net
echo htmlentities($str);  // Output: © 2023 Plus2Net

Subhendu Mohapatra

Author & Instructor at plus2net

I write and maintain practical tutorials on Python, PHP, SQL, JavaScript, HTML, jQuery, and web development at plus2net. The tutorials focus on clear explanations, working examples, and code that readers can test and adapt while learning.

About the author   Watch on YouTube

Connect: