The htmlspecialchars() Function

The htmlspecialchars() function converts only the essential special characters into their corresponding HTML entities. This is crucial when outputting data entered by users (e.g., in comment sections), as it prevents anyone from injecting malicious JavaScript code that would otherwise execute in the browsers of other visitors.

Note for the simulator: Since some string functions (such as htmlentities, htmlspecialchars, and html_entity_decode) modify raw HTML characters, the browser in the output window might not always display the exact raw output (as it automatically processes it). To see how these functions truly behave, we highly recommend copying and testing the code locally in your IDE (e.g., PhpStorm, VS Code).

EXAMPLE

<?php
echo "1. Preventing HTML tags from executing:<br>";
$input = "PHP String";
// We use double encoding for the correct visual representation of entities
echo htmlentities(htmlspecialchars($input)) . "<br>";

echo "<br>2. Difference: htmlspecialchars does not convert all symbols:<br>";
$symbols = "© & ®";
echo "htmlspecialchars: " . htmlentities(htmlspecialchars($symbols)) . "<br>";

echo "<br>3. Handling quotes correctly (ENT_QUOTES):<br>";
$string = 'Guide to "PHP" Programming';
echo htmlentities(htmlspecialchars($string, ENT_QUOTES)) . "<br>";

// TIP: Always use this function when outputting data into HTML forms 
// to prevent issues with quotation marks.
?>

RESULT

Specific Characters

Predefined characters that get converted:

& (ampersand): becomes &
< (less than): becomes <
> (greater than): becomes >
" (double quote): becomes "
' (single quote): becomes ' (only with ENT_QUOTES)