htmlentities() vs htmlspecialchars() in PHP: Full Breakdown with Examples

htmlentities() vs. htmlspecialchars(): Battle of the Escaping Titans in PHP

If you've ever dealt with outputting user data on a web page, you've likely heard of the functions htmlentities() and htmlspecialchars(). These are PHP's two main tools for protecting against XSS attacks and correctly displaying HTML characters. But what's the difference between them? Which one should a beginner choose, and which one should a pro choose? Let's figure it out once and for all.

Imagine: you're writing a blog in PHP, and a user enters a comment: <script>alert('XSS')</script>. If you simply output this to the screen, the browser will execute the script. Disaster! This is where htmlspecialchars() and htmlentities() come to the rescue. But each one works differently.

What do htmlspecialchars() and htmlentities() have in common?

Both functions convert special HTML characters into their HTML entities. For example:

\n
• & (ampersand) → &
\n
• < (less than) → <
\n
• > (greater than) → >
\n
• " (double quote) → "
\n
• ' (single quote) → ' (or ' depending on the flag)
\n

Without them, any input with angle brackets or ampersands will break the layout or open the door for hackers.

The Main Difference: Scope of Conversion

Herein lies the secret. htmlspecialchars() is the economical fighter. It only converts the five main characters that have direct meaning in HTML:

\n
• & → &
\n
• < → <
\n
• > → >
\n
• " → "
\n
• ' → ' (if the ENT_QUOTES flag is enabled)
\n

While htmlentities() is a perfectionist. It converts all characters for which HTML entities exist. This includes not only angle brackets, but also currency symbols (€, £, ¥), mathematical signs (∑, ∂), letters with diacritical marks (é, ñ, ü), and even emojis (☺).

Simple Example: The Difference in Practice

Let's look at the code. Suppose we have a string with French text:

<?php\n$text = "Café & thé <script>alert('test')</script>";\necho "htmlspecialchars: " . htmlspecialchars($text, ENT_QUOTES, 'UTF-8') . "<br>";\necho "htmlentities: " . htmlentities($text, ENT_QUOTES, 'UTF-8');\n?>

Result:

htmlspecialchars: Café & thé <script>alert('test')</script>\nhtmlentities: Café & thé <script>alert('test')</script>

In this example, there is no difference because the characters "é" and other Latin letters have no special meaning in HTML. But let's try with characters that do have entities:

<?php\n$text = "€ 100 <b>bold</b>";\necho "htmlspecialchars: " . htmlspecialchars($text, ENT_QUOTES, 'UTF-8') . "<br>";\necho "htmlentities: " . htmlentities($text, ENT_QUOTES, 'UTF-8');\n?>

Result:

htmlspecialchars: € 100 <b>bold</b>\nhtmlentities: &euro; 100 <b>bold</b>

See? htmlentities() converted the euro symbol "€" into its entity €. While htmlspecialchars() left it as is. Why? Because "€" is not a dangerous character for HTML — the browser will display it correctly even without escaping.

When to use htmlspecialchars()?

This is your default choice. Use htmlspecialchars() in 99% of cases when you output user