htmlentities
Converts all applicable characters to HTML entities.
Syntax
htmlentities(string $string, int $flags = ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401, ?string $encoding = null): stringParameters
| Parameter | Type | Description |
|---|---|---|
| $string | string | The input string. |
| $flags | int | Optional. How to treat quotes. |
| $encoding | ?string | Optional. The encoding, UTF-8 by default. |
Return value
stringThe string with entities.
Examples
Compared with htmlspecialchars():
<?php
echo htmlentities('Café <b>€5</b>'), "\n";
echo htmlspecialchars('Café <b>€5</b>');Output:
Café <b>€5</b>
Café <b>€5</b>Notes
For output on a UTF-8 page htmlspecialchars() is enough: it replaces only the dangerous characters.
See also
- htmlspecialchars — Replaces HTML special characters with safe entities.
- html_entity_decode — Turns HTML entities back into characters.
- strip_tags — Removes HTML tags from a string.
In the tutorial
- Security — The basics of PHP site security — XSS and escaping, SQL injection, password hashing, CSRF tokens and validating input.