PHP htmlspecialchars Function: Prevent XSS in HTML Output

A PHP script can break the page or allow code injection if it outputs user input directly into HTML. The PHP htmlspecialchars function fixes this. It converts unsafe characters into safe HTML. This protects your site and keeps the output clean.

Understand the htmlspecialchars() Function in PHP

The htmlspecialchars() function in PHP changes special characters into HTML-safe codes. This prevents browsers from treating text as actual HTML tags or scripts. It works as a basic shield for user input.

Here is the syntax:

htmlspecialchars($string, $flags, $encoding, $double_encode)

Parameters:

• $string: the input text.
• $flags: control how quotes are handled.
• $encoding: character set (UTF-8 is common).
• $double_encode: already-encoded entities will be encoded again if true.

The function returns a safe version of the input text with converted characters.

Here is an example:

echo htmlspecialchars("<b>Hello</b>");

This prints <b>Hello</b>, not bold text. It removes the risk of unexpected HTML display.

Here is another example:

$user = '"admin"';
echo htmlspecialchars($user, ENT_QUOTES);

This prints "admin". The ENT_QUOTES flag converts both single and double quotes to HTML-safe form.

The browser may treat it like a tag if you print a name like <John> into HTML. This can break layout or allow scripts. The function turns < into < and makes it show as text. It stops cross-site scripting (XSS) and keeps your page safe.

How to Decode HTML Entities with htmlspecialchars_decode()

The htmlspecialchars_decode() function does the opposite of htmlspecialchars(). It turns encoded HTML entities like < and > back into their original characters, such as < and >.

This is useful when you want to display actual HTML tags from stored text that was previously encoded for safety.

$text = "<p>Test</p>";
echo htmlspecialchars_decode($text);

The output becomes actual HTML:

<p>Test</p>

The browser shows the real paragraph tag instead of the plain text <p>Test</p>.

The Difference Between htmlspecialchars() and htmlentities()

The htmlspecialchars() function only converts five key characters: &, <, >, ", and '. These are the most common ones that can break HTML layout or pose security risks in forms and user input.

The htmlentities() function goes further. It converts all characters that have a HTML entity, such as ©, €, ™, and many symbols. This gives broader protection but is not always needed for simple HTML output.

An HTML entity starts with & and ends with ;. It replaces characters that HTML uses for layout.
Here are a few examples:

• < becomes <
• > becomes >
• " becomes "
• ' becomes '
• & becomes &

These make sure the browser does not treat them as code.

Protect User Input with htmlspecialchars()

Forms accept any kind of input. Users can type text or code. Or even HTML. Browsers run that HTML if you print it raw.

Use htmlspecialchars() before you show the input. It changes unsafe characters to safe ones. The browser shows them as plain text.

This supports contact forms and comments with usernames. You protect the page and block JavaScript execution.

Here is an example:

$name = $_POST['name'];
echo "Hello, " . htmlspecialchars($name);

If someone enters:

<script>alert('Hacked!');</script>

The function turns it into this:

Hello, <script>alert('Hacked!');</script>

The browser does not run anything. It just prints the characters. That stops cross-site script attacks.

How to Handle Quotes with ENT_QUOTES and Other Flags

htmlspecialchars() changes double quotes by default. It leaves single quotes as they are. Use ENT_QUOTES to convert both.

This matters when you place user input inside HTML attributes. A stray quote can break the tag or end it early.

Here are the common flags:

• ENT_COMPAT: default mode. Converts double quotes only.
• ENT_QUOTES: converts both double and single quotes.
• ENT_NOQUOTES: skips both types. Leaves quotes untouched.

Pick the flag based on where you use the output. Inside tags, always escape both types.

UTF-8 and Character Encoding in htmlspecialchars()

Set the right encoding to avoid broken output. Use 'UTF-8' for modern sites.

Missing or wrong encoding causes problems. Characters may break or turn into symbols like �.

htmlspecialchars($text, ENT_QUOTES, 'UTF-8');

This keeps symbols like é, ✓, or — safe. The browser shows them correctly. Nothing breaks.

Wrapping Up

In this article, you learned how the PHP htmlspecialchars function keeps your site safe and clean. You saw how it converts unsafe characters, how to decode them, and how to handle quotes and encoding.

Here is a quick recap:

• Use htmlspecialchars() to stop code injection.
• Use htmlspecialchars_decode() to show real HTML again.
• Choose between htmlspecialchars() and htmlentities() based on your output needs.
• Handle quotes with the right flag.
• Always set encoding to UTF-8.

FAQs

echo htmlspecialchars("<b>Hello</b>");

$str = '<b>Hi</b>';
echo htmlspecialchars_decode($str);
// Output: <b>Hi</b>

$encoded = base64_encode("Hello");
echo base64_decode($encoded); // Output: Hello

echo hex2bin("48656c6c6f"); // Output: Hello