php-doc-en/reference/strings/functions/htmlspecialchars.xml

<?xml version="1.0" encoding="utf-8"?>
<!-- $Revision$ -->
<refentry xmlns="http://docbook.org/ns/docbook" xml:id="function.htmlspecialchars" xmlns:xlink="http://www.w3.org/1999/xlink">
 <refnamediv>
  <refname>htmlspecialchars</refname>
  <refpurpose>Convert special characters to HTML entities</refpurpose>
 </refnamediv>

 <refsect1 role="description">
  &reftitle.description;
  <methodsynopsis>
   <type>string</type><methodname>htmlspecialchars</methodname>
   <methodparam><type>string</type><parameter>string</parameter></methodparam>
   <methodparam choice="opt"><type>int</type><parameter>flags</parameter><initializer>ENT_COMPAT | ENT_HTML401</initializer></methodparam>
   <methodparam choice="opt"><type>string</type><parameter>encoding</parameter><initializer>'UTF-8'</initializer></methodparam>
   <methodparam choice="opt"><type>bool</type><parameter>double_encode</parameter><initializer>true</initializer></methodparam>
  </methodsynopsis>
  <para>
   Certain characters have special significance in HTML, and should
   be represented by HTML entities if they are to preserve their
   meanings. This function returns a string with some of these
   conversions made; the translations made are those most
   useful for everyday web programming. If you require all HTML
   character entities to be translated, use
   <function>htmlentities</function> instead.
  </para>
  <simpara>
   This function is useful in preventing user-supplied text from
   containing HTML markup, such as in a message board or guest book
   application.
  </simpara>
  <para>
   The translations performed are:
   <itemizedlist>
    <listitem>
     <simpara>
      '&amp;' (ampersand) becomes '&amp;amp;'
     </simpara>
    </listitem>
    <listitem>
     <simpara>
      '&quot;' (double quote) becomes '&amp;quot;' when <constant>ENT_NOQUOTES</constant>
      is not set.
     </simpara>
    </listitem>
    <listitem>
     <simpara>
      &quot;&#039;&quot; (single quote) becomes '&amp;#039;' only when
      <constant>ENT_QUOTES</constant> is set.
     </simpara>
    </listitem>
    <listitem>
     <simpara>
      '&lt;' (less than) becomes '&amp;lt;'
     </simpara>
    </listitem>
    <listitem>
     <simpara>
      '&gt;' (greater than) becomes '&amp;gt;'
     </simpara>
    </listitem>
   </itemizedlist>
  </para>
 </refsect1>

 <refsect1 role="parameters">
  &reftitle.parameters;
  <para>
   <variablelist>
    <varlistentry>
     <term><parameter>string</parameter></term>
     <listitem>
      <para>
       The <type>string</type> being converted.
      </para>
     </listitem>
    </varlistentry>
    <varlistentry>
     <term><parameter>flags</parameter></term>
     <listitem>
      <para>
       A bitmask of one or more of the following flags, which specify how to handle quotes,
       invalid code unit sequences and the used document type. The default is
       <literal>ENT_COMPAT | ENT_HTML401</literal>.
       <table>
        <title>Available <parameter>flags</parameter> constants</title>
        <tgroup cols="2">
         <thead>
          <row>
           <entry>Constant Name</entry>
           <entry>Description</entry>
          </row>
         </thead>
         <tbody>
          <row>
           <entry><constant>ENT_COMPAT</constant></entry>
           <entry>Will convert double-quotes and leave single-quotes alone.</entry>
          </row>
          <row>
           <entry><constant>ENT_QUOTES</constant></entry>
           <entry>Will convert both double and single quotes.</entry>
          </row>
          <row>
           <entry><constant>ENT_NOQUOTES</constant></entry>
           <entry>Will leave both double and single quotes unconverted.</entry>
          </row>
          <row>
           <entry><constant>ENT_IGNORE</constant></entry>
           <entry>
            Silently discard invalid code unit sequences instead of returning
            an empty string. Using this flag is discouraged as it
            <link xlink:href="&url.delete.nonchars;">may have security implications</link>.
           </entry>
          </row>
          <row>
           <entry><constant>ENT_SUBSTITUTE</constant></entry>
           <entry>
            Replace invalid code unit sequences with a Unicode Replacement Character
            U+FFFD (UTF-8) or &amp;#FFFD; (otherwise) instead of returning an empty string.
           </entry>
          </row>
          <row>
           <entry><constant>ENT_DISALLOWED</constant></entry>
           <entry>
            Replace invalid code points for the given document type with a
            Unicode Replacement Character U+FFFD (UTF-8) or &amp;#FFFD;
            (otherwise) instead of returning an empty string. This may be
            useful, for instance, to ensure the well-formedness of XML documents            with embedded external content.
           </entry>
          </row>
          <row>
           <entry><constant>ENT_HTML401</constant></entry>
           <entry>
            Handle code as HTML 4.01.
           </entry>
          </row>
          <row>
           <entry><constant>ENT_XML1</constant></entry>
           <entry>
            Handle code as XML 1.
           </entry>
          </row>
          <row>
           <entry><constant>ENT_XHTML</constant></entry>
           <entry>
            Handle code as XHTML.
           </entry>
          </row>
          <row>
           <entry><constant>ENT_HTML5</constant></entry>
           <entry>
            Handle code as HTML 5.
           </entry>
          </row>
         </tbody>
        </tgroup>
       </table>
      </para>
     </listitem>
    </varlistentry>
    <varlistentry>
     <term><parameter>encoding</parameter></term>
     <listitem>
      <para>
       Defines encoding used in conversion.
       If omitted, the default value for this argument is ISO-8859-1 in
       versions of PHP prior to 5.4.0, and UTF-8 from PHP 5.4.0 onwards.
      </para>
      <para>
       For the purposes of this function, the encodings
       <literal>ISO-8859-1</literal>, <literal>ISO-8859-15</literal>,
       <literal>UTF-8</literal>, <literal>cp866</literal>,
       <literal>cp1251</literal>, <literal>cp1252</literal>, and
       <literal>KOI8-R</literal> are effectively equivalent, provided the
       <parameter>string</parameter> itself is valid for the encoding, as
       the characters affected by <function>htmlspecialchars</function> occupy
       the same positions in all of these encodings.
      </para>
      &reference.strings.charsets;
     </listitem>
    </varlistentry>
    <varlistentry>
     <term><parameter>double_encode</parameter></term>
     <listitem>
      <para>
       When <parameter>double_encode</parameter> is turned off PHP will not
       encode existing html entities, the default is to convert everything.
      </para>
     </listitem>
    </varlistentry>
   </variablelist>
  </para>
 </refsect1>

 <refsect1 role="returnvalues">
  &reftitle.returnvalues;
  <para>
   The converted <type>string</type>.
  </para>
  <para>
   If the input <parameter>string</parameter> contains an invalid code unit
   sequence within the given <parameter>encoding</parameter> an empty string
   will be returned, unless either the <constant>ENT_IGNORE</constant> or
   <constant>ENT_SUBSTITUTE</constant> flags are set.
  </para>
 </refsect1>

 <refsect1 role="changelog">
  &reftitle.changelog;
  <para>
   <informaltable>
    <tgroup cols="2">
     <thead>
      <row>
       <entry>&Version;</entry>
       <entry>&Description;</entry>
      </row>
     </thead>
     <tbody>
      <row>
       <entry>5.4.0</entry>
       <entry>
        The default value for the <parameter>encoding</parameter> parameter was
        changed to UTF-8.
       </entry>
      </row>
      <row>
       <entry>5.4.0</entry>
       <entry>
        The constants <constant>ENT_SUBSTITUTE</constant>, <constant>ENT_DISALLOWED</constant>,
        <constant>ENT_HTML401</constant>, <constant>ENT_XML1</constant>,
        <constant>ENT_XHTML</constant> and <constant>ENT_HTML5</constant> were added.
       </entry>
      </row>
      <row>
       <entry>5.3.0</entry>
       <entry>
        The constant <constant>ENT_IGNORE</constant> was added.
       </entry>
      </row>
      <row>
       <entry>5.2.3</entry>
       <entry>
        The <parameter>double_encode</parameter> parameter was added.
       </entry>
      </row>
      <row>
       <entry>4.1.0</entry>
       <entry>
        The <parameter>encoding</parameter> parameter was added.
       </entry>
      </row>
     </tbody>
    </tgroup>
   </informaltable>
  </para>
 </refsect1>

 <refsect1 role="examples">
  &reftitle.examples;
  <para>
   <example>
    <title><function>htmlspecialchars</function> example</title>
    <programlisting role="php">
<![CDATA[
<?php
$new = htmlspecialchars("<a href='test'>Test</a>", ENT_QUOTES);
echo $new; // &lt;a href=&#039;test&#039;&gt;Test&lt;/a&gt;
?>
]]>
    </programlisting>
   </example>
  </para>
 </refsect1>

 <refsect1 role="notes">
  &reftitle.notes;
  <note>
   <para>
    Note that this function does not translate anything beyond what
    is listed above. For full entity translation, see
    <function>htmlentities</function>.
   </para>
  </note>
 </refsect1>

 <refsect1 role="seealso">
  &reftitle.seealso;
  <para>
   <simplelist>
    <member><function>get_html_translation_table</function></member>
    <member><function>htmlspecialchars_decode</function></member>
    <member><function>strip_tags</function></member>
    <member><function>htmlentities</function></member>
    <member><function>nl2br</function></member>
   </simplelist>
  </para>
 </refsect1>

</refentry>

<!-- Keep this comment at the end of the file
Local variables:
mode: sgml
sgml-omittag:t
sgml-shorttag:t
sgml-minimize-attributes:nil
sgml-always-quote-attributes:t
sgml-indent-step:1
sgml-indent-data:t
indent-tabs-mode:nil
sgml-parent-document:nil
sgml-default-dtd-file:"~/.phpdoc/manual.ced"
sgml-exposed-tags:nil
sgml-local-catalogs:nil
sgml-local-ecat-files:nil
End:
vim600: syn=xml fen fdm=syntax fdl=2 si
vim: et tw=78 syn=sgml
vi: ts=1 sw=1
-->