htmlspecialchars() / htmlentities() Since: PHP 4（2000）

// Escapes special HTML characters.
htmlspecialchars($string, $flags, $encoding, $double_encode);

// Escapes all HTML character entities.
htmlentities($string, $flags, $encoding, $double_encode);

// Converts HTML character entities back to their original characters.
html_entity_decode($string, $flags, $encoding);

// Strips HTML tags from a string.
strip_tags($string, $allowed_tags);

Returns the converted string. The original string is not modified.

<?php
// Basic usage to prevent XSS attacks.
$user_input = '<script>alert("XSS")</script>';
echo htmlspecialchars($user_input, ENT_QUOTES, "UTF-8"); // The tags are escaped and displayed safely.

// The five characters that get converted.
$str = '& " \' < >';
echo htmlspecialchars($str, ENT_QUOTES, "UTF-8"); // Outputs: &amp; &quot; &#039; &lt; &gt;

// Example of safely displaying form input.
$name = '<b>John Doe</b>';
echo '<p>' . htmlspecialchars($name, ENT_QUOTES, "UTF-8") . '</p>'; // Outputs safe HTML with tags neutralized.

// htmlentities() converts a wider range of characters.
echo htmlentities("© 2026", ENT_QUOTES, "UTF-8"); // The copyright symbol is also converted to a character entity.

// Use html_entity_decode() to reverse the conversion.
$encoded = "&lt;p&gt;Test&lt;/p&gt;";
echo html_entity_decode($encoded, ENT_QUOTES, "UTF-8"); // Outputs: <p>Test</p>

// Use strip_tags() to remove HTML tags.
$html = "<p>This is a <b>bold</b> <a href='#'>link</a>.</p>";
echo strip_tags($html); // Outputs: This is a bold link.

// Specify allowed tags in the second argument.
echo strip_tags($html, "<b><p>"); // Outputs: <p>This is a <b>bold</b> link.</p>

// Why the ENT_QUOTES flag matters.
$value = '" onmouseover="alert(1)';
echo '<input value="' . htmlspecialchars($value, ENT_QUOTES, "UTF-8") . '">'; // Double quotes are also escaped.

htmlspecialchars() is the fundamental function for XSS prevention. Always use it when outputting user input to HTML. Always pass ENT_QUOTES as the second argument. Omitting it leaves single quotes unescaped, which can allow XSS attacks inside HTML attribute values. It is also recommended to explicitly specify "UTF-8" as the third argument.

htmlentities() converts a wider range of characters than htmlspecialchars(), but htmlspecialchars() is sufficient for typical XSS prevention. html_entity_decode() performs the reverse conversion and is useful when you need to restore previously escaped data stored in a database.

strip_tags() removes HTML tags entirely and is convenient when you need plain text. However, it is not a complete XSS countermeasure, so use htmlspecialchars() when outputting to the screen. For URL encoding, use urlencode().