htmlspecialchars

In PHP, the htmlspecialchars function is used to convert special characters to their corresponding HTML entities. This function is particularly important in web development for preventing Cross-Site Scripting (XSS) attacks by escaping characters that could otherwise be interpreted and executed as HTML or JavaScript.

htmlspecialchars specifically targets characters that have special significance in HTML such as:

  • Ampersand (&)
  • Double quote (")
  • Single quote (')
  • Less than (<)
  • Greater than (>)

The basic syntax is:

string htmlspecialchars(string $string, int $flags = ENT_COMPAT, string $encoding = 'UTF-8', bool $double_encode = true)
  • $string: The string to be converted.
  • $flags (optional): A bitmask that controls the behavior. Common flags include ENT_COMPAT (default, converts double quotes), ENT_QUOTES (converts both double and single quotes), and ENT_NOQUOTES (does not convert any quotes).
  • $encoding (optional): Defines the character encoding. If not specified, the default is 'UTF-8'.
  • $double_encode (optional): When set to true (default), it will convert existing HTML entities to their entity-encoded versions. If set to false, it will leave existing HTML entities as-is.

An example may be:

$input = "<script>alert('XSS');</script>";
$escapedInput = htmlspecialchars($input, ENT_QUOTES, 'UTF-8');
echo $escapedInput; // Outputs: &lt;script&gt;alert(&#039;XSS&#039;);&lt;/script&gt;

In this example, htmlspecialchars converts the special characters in $input to HTML entities, rendering the script harmless if echoed to a web page.