htmlspecialchars_decode
Converts the `<`, `>`, `&`, `"` entities back to characters.
Syntax
htmlspecialchars_decode(string $string, int $flags = ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401): stringParameters
| Parameter | Type | Description |
|---|---|---|
| $string | string | A string with entities. |
| $flags | int | Optional. How to treat quotes. |
Return value
stringThe string with regular characters.
Examples
The reverse conversion:
<?php
echo htmlspecialchars_decode('Tom & Jerry <3');Output:
Tom & Jerry <3Notes
Keep data in the database in its original form and escape only on output — then no reverse conversion is needed.
See also
- htmlspecialchars — Replaces HTML special characters with safe entities.
- html_entity_decode — Turns HTML entities back into characters.
- strip_tags — Removes HTML tags from a string.
In the tutorial
- Security — The basics of PHP site security — XSS and escaping, SQL injection, password hashing, CSRF tokens and validating input.