PHP htmlentities

Question

When I use htmlentities() function in my PHP projects, should I always use it with a flag so it is compatible with other language characters?

$my_variable = $some_data;
$output_variable = htmlentities($my_variable);

or...

$my_variable = $some_data;
$output_variable = htmlentities($my_variable, ENT_COMPAT, 'UTF-8');

If neither of the above, what is the proper way to use this function.

Thank you!

That depends: Is the data in $some_data actually encoded with UTF-8? — Gumbo
– Gumbo, Commented Jun 26, 2011 at 21:13
@Gumbo, The data comes from a MySQL database. Using htmlentities() works fine for me but the output looks incorrect in some other languages. — usnidorg
– usnidorg, Commented Jun 26, 2011 at 21:26

Quentin · Accepted Answer · 2011-06-26 21:16:46Z

1

Generally speaking, you shouldn't use it at all. Specifying the encoding used in the Content-Type HTTP header and then using real characters instead of entities is generally more efficient. (OTOH, you should use htmlspecialchars to convert characters which have special meaning in HTML to entities).

If you do use it, then you need to specify what encoding you are converting from if you aren't using the default (ISO-8859-1). Specifying UTF-8 when you aren't using UTF-8 is less than helpful.

answered Jun 26, 2011 at 21:16

Quentin

949k136 gold badges1.3k silver badges1.4k bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

usnidorg Over a year ago

When I display user provided data from the database, I need to filter it to prevent execution f malicious code. I was told here on stackoverflow to use htmlentities() when outputting data. Is this not correct? Should I use htmlspecialchars instead?

Quentin Over a year ago

htmlspecialchars is sufficient, it handles the characters which have special meaning in HTML.

usnidorg Over a year ago

@Quentine, I found this: htmlspecialchars() will NOT protect you against UTF-7 XSS exploits, that still plague Internet Explorer, even in IE 9. stackoverflow.com/questions/3623236/… . I guess this is why I was using htmlentities. This is really confusing.

James Long · Accepted Answer · 2011-06-26 21:15:38Z

0

If you're unsure what charset you're using, the second way it the better. However, for most occasions, you'll find that the first one is fine.

answered Jun 26, 2011 at 21:15

James Long

4,7681 gold badge23 silver badges31 bronze badges

Collectives™ on Stack Overflow

PHP htmlentities

2 Answers 2

3 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related