The htmlentities() Function

The htmlentities() function is key to security. It converts all characters that have corresponding HTML entities into those entities (e.g., © becomes ©). This prevents the browser from interpreting characters as HTML code. To do the reverse, we use html_entity_decode().

Note for the simulator: Since some string functions (such as htmlentities, htmlspecialchars, and html_entity_decode) modify raw HTML characters, the browser in the output window might not always display the exact raw output (as it automatically processes it). To see how these functions truly behave, we highly recommend copying and testing the code locally in your IDE (e.g., PhpStorm, VS Code).

EXAMPLE

<?php
echo "1. Basic conversion of HTML code into a safe string:<br>";
$link = '<a href="https://vadnica.org/">vadnica.org</a>';
echo htmlentities($link) . "<br>";

echo "<br>2. Difference in handling quotes:<br>";
$text = "Borut's 'PHP' \"String\" library! ©";

echo "ENT_COMPAT (double \" only): " . htmlentities($text, ENT_COMPAT) . "<br>";
echo "ENT_QUOTES (both double and single '): " . htmlentities($text, ENT_QUOTES) . "<br>";
echo "ENT_NOQUOTES (no quotes): " . htmlentities($text, ENT_NOQUOTES) . "<br>";

// Tip: Always use ENT_QUOTES if you want to be 100% safe 
// when printing user inputs into HTML attributes.
?>

RESULT

Flags and Character Sets

Flags determine how the function handles quotation marks:

ENT_COMPAT: Converts double quotes only (default).
ENT_QUOTES: Converts both double and single quotes.
ENT_NOQUOTES: Leaves all quotation marks in their original form.

By default, the UTF-8 character encoding is used. The function also supports ENT_HTML401, ENT_XML1, ENT_XHTML, and ENT_HTML5 standards.