PHP
downloads | documentation | faq | getting help | mailing lists | reporting bugs | php.net sites | links | conferences | my php.net

search for in the

htmlspecialchars_decode> <html_entity_decode
Last updated: Fri, 04 Jul 2008

view this page in

htmlentities

(PHP 4, PHP 5)

htmlentities — Convierte todos los caracteres a su entidad HTML aplicable

Descripción

string htmlentities ( string $string [, int $quote_style [, string $charset ]] )

Esta función es identica en todo a htmlspecialchars(), excepto que con htmlentities(), todos los caracteres que tengan una entidad equivalente en HTML serán cambiados a esas entidades.

En htmlspecialchars(), el parámetro opcional quote_style le permite definir lo que será hecho con las comillas 'sencillas' y las "dobles". Toma uno de tres constantes con ENT_COMPAT:

Constantes disponibles para quote_style
Nombre de Constante Descripción
ENT_COMPAT Convertirá las dobles comillas y dejará solo las comillas sencillas.
ENT_QUOTES Convertirá las comillas dobles y sencillas.
ENT_NOQUOTES Mantendrá las comillas dobles y sencillas sin cambios.

El parámetro opcional quote fue agregado en PHP 4.0.3.

Además htmlspecialchars(), tiene un tercer parámetro opcional charset el cual define el conjunto de caracteres que serán utilizados en la conversión. Este parámetro fue agregado en PHP 4.1.0. Actualmente, el conjunto de caracteres IS-8859-1 es usado como valor por defecto.

Los siguientes juegos de caracteres son soportados a partir de PHP 4.3.0.

Juegos de caracteres soportados
Juego de caracteres Aliases Descripción
ISO-8859-1 ISO8859-1 Europeo Occidental, Latin-1
ISO-8859-15 ISO8859-15 Europeo Occidental, Latin-9. Añade el signo de Euro, y letras del Francés y Finlandés que hacían falta en Latin-1(ISO-8859-1).
UTF-8   Multi-byte Unicode de 8-bits compatible con ASCII.
cp866 ibm866, 866 Juego de caracteres cirílicos específico de DOS. Este juego de caracteres está soportado en 4.3.2.
cp1251 Windows-1251, win-1251, 1251 Juego de caracteres cirílicos específico de Windows. Este juego de caracteres está soportado en 4.3.2.
cp1252 Windows-1252, 1252 Juego de caracteres específico de Windows para Europa Occidental.
KOI8-R koi8-ru, koi8r Ruso. Este juego de caracteres está soportado en 4.3.2.
BIG5 950 Chino Tradicional, usado principalmente en Taiwán.
GB2312 936 Chino Simplificado, juego de caracteres estándar nacional.
BIG5-HKSCS   Big5 con extensiones de Hong Kong, Chino Tradicional.
Shift_JIS SJIS, 932 Japonés
EUC-JP EUCJP Japonés

Note: Cualquier otro juego de caracteres no es reconocido y en su lugar se utilizará ISO-8859-1.

Si quiere hacer la operación inversa puede usar html_entity_decode().

Example #1 Un ejemplo de htmlentities()

<?php
$str = "A 'quote' is <b>bold</b>";

// Outputs: A 'quote' is &lt;b&gt;bold&lt;/b&gt;
echo htmlentities($str);

// Outputs: A &#039;quote&#039; is &lt;b&gt;bold&lt;/b&gt;
echo htmlentities($str, ENT_QUOTES);
?>

Vea también html_entity_decode(), get_html_translation_table(), htmlspecialchars(), nl2br(), y urlencode().



htmlspecialchars_decode> <html_entity_decode
Last updated: Fri, 04 Jul 2008
 
add a note add a note User Contributed Notes
htmlentities
keenskelly at gmail dot com
07-Jul-2008 10:23
So here's something fun: if you create an XML document in PHP and use htmlentities() to encode text data, then later want to read and parse the same document with PHP's xml_parse(), unless you include entity declarations into the generated document, the parser will stop on the unknown entities.

To account for this, I created a small function to take the translation table and turn it into XML <!ENTITY> definitions. I insert this output into the XML document immediately after the <?xml?> line and the parse errors magically vanish:

// Generate a list of entity declarations from the HTML_ENTITIES set that PHP knows about to dump into the document
function htmlentities_entities() {
        $output = '';
        foreach (get_html_translation_table(HTML_ENTITIES) as $value) {
                $name = substr($value, 1, strlen($value) - 2);
                switch ($name) {
                        // These ones we can skip because they're built into XML
                        case 'nbsp':
                        case 'gt':
                        case 'lt':
                        case 'quot':
                        case 'apos':
                        case 'amp': break;
                        default: $output .= "<!ENTITY {$name} \"&{$name};\">\n";
                }
        }
        return($output);
}
anju at mycompany dot com
24-Jun-2008 12:32
The example below was very helpful. I was trying to make an rss feed for the data which comes from various sources. Thanks Cameron.

cameron at prolifique dot com
http://www.prolifique.com/entities.php.txt
silverquick at gmail dot com
17-Jun-2008 03:22
@vicrry at yahoo dot com
This function does encode *non-breaking* spaces to &nbsp;, but normal spaces are not equivalent to &nbsp;.
nacho dot exr at gmail dot com
23-May-2008 03:25
For the <mat at matinfo dot ch> function 'convertLatin1ToHtml'

a performance improvement: use strtr instead of str_replace:

foreach ($html_entities as $key => $value) {
        $str = str_replace($key, $value, $str);
    }

goes to:

$str = strtr($str,$html_entities);

that's all ;)
eric at tillandsia dot nl
13-May-2008 12:06
I don't know, but I get a lott of warnings about unknown html entities when I use the function:

htmlentities($str,HTML_ENTITIES,'UTF-8')

The function below works fine for me, just a replacement by  a decimal coding.
A str_replace for each possible latin character in a string as in an earlier example using a hash table is slowing down the script, because you go through the string for each latin character again. In the example below, you will go through it only once.
 
function parseXMLcoding($string)
{
    if ( strlen($string) == 0 )
        return $string;
       
    $string = preg_split("//", $string, -1, PREG_SPLIT_NO_EMPTY);

    for ( $i = 0; $i < count($string); $i++ )
    {
        $dec = ord($string[$i]);
       
        if ( $dec > 127 )
            $string[$i] = '&#' . $dec . ';';
    }
   
    return implode('',$string);
}
vicrry at yahoo dot com
24-Apr-2008 09:33
my code has been like this ugly all the time:

echo nl2br( str_replace(' ','&nbsp;', htmlentities( $string ) ) );

it would be great if this function has the option to encode spaces to &nbsp;(s), because it's also among the html special char equivalents.
mat at matinfo dot ch
21-Apr-2008 11:34
Hi,

below a method to convert UTF-8 Latin-1 characters to HTML-Entity,
I'm created this to translate string with HTML element on it and i just wont to convert entities.

function convertLatin1ToHtml($str) {
    $html_entities = array (
        "&" =>  "&amp;",     #ampersand  
        "á" =>  "&aacute;",     #latin small letter a
        "Â" =>  "&Acirc;",     #latin capital letter A
        "â" =>  "&acirc;",     #latin small letter a
        "Æ" =>  "&AElig;",     #latin capital letter AE
        "æ" =>  "&aelig;",     #latin small letter ae
        "À" =>  "&Agrave;",     #latin capital letter A
        "à" =>  "&agrave;",     #latin small letter a
        "Å" =>  "&Aring;",     #latin capital letter A
        "å" =>  "&aring;",     #latin small letter a
        "Ã" =>  "&Atilde;",     #latin capital letter A
        "ã" =>  "&atilde;",     #latin small letter a
        "Ä" =>  "&Auml;",     #latin capital letter A
        "ä" =>  "&auml;",     #latin small letter a
        "Ç" =>  "&Ccedil;",     #latin capital letter C
        "ç" =>  "&ccedil;",     #latin small letter c
        "É" =>  "&Eacute;",     #latin capital letter E
        "é" =>  "&eacute;",     #latin small letter e
        "Ê" =>  "&Ecirc;",     #latin capital letter E
        "ê" =>  "&ecirc;",     #latin small letter e
        "È" =>  "&Egrave;",     #latin capital letter E
... sorry cutting because limitation of php.net ...
... but the principle is it ;) ...
        "û" =>  "&ucirc;",     #latin small letter u
        "Ù" =>  "&Ugrave;",     #latin capital letter U
        "ù" =>  "&ugrave;",     #latin small letter u
        "Ü" =>  "&Uuml;",     #latin capital letter U
        "ü" =>  "&uuml;",     #latin small letter u
        "Ý" =>  "&Yacute;",     #latin capital letter Y
        "ý" =>  "&yacute;",     #latin small letter y
        "ÿ" =>  "&yuml;",     #latin small letter y
        "Ÿ" =>  "&Yuml;",     #latin capital letter Y
    );

    foreach ($html_entities as $key => $value) {
        $str = str_replace($key, $value, $str);
    }
    return $str;
}
za at byza dot it
15-Apr-2008 09:15
Trouble when using files with different charset?

htmlentities and html_entity_decode can be used to translate between charset!

Sample function:

function utf2latin($text) {
   $text=htmlentities($text,ENT_COMPAT,'UTF-8');
   return html_entity_decode($text,ENT_COMPAT,'ISO-8859-1');
}
richard at aggmedia dot net
12-Mar-2008 08:32
From SR:

> There's no sane reason to use htmlentities() instead
> of htmlspecialchars(). As long as you specify the charset
> of a page with a Content-Type meta in the head of a
> page (which you should ALWAYS do in the first place),
> escaping all characters is completely pointless and will
> only grow the size of your page. Only the special HTML
> characters (<, >, &, etc.) need to be escaped, which is
> exactly what htmlspecialchars() does

This is inaccurate and unhelpful.

There are many cases where you would want to convert a UTF-8 (or other) encoded string into appropriate HTML entity representations, as well as being just good practice to use more compatable entities instead of embedded character encodings.

One such example is when using JavaScript for string manipulation, which doesn't support character sets and thus does not respect the UTF-8 BOM. By converting to full entities, JavaScript works with the entity text instead of byte codes.

So long as the developer understands what is happening with encoding and how character sets work, they should make their own call on which function they need to use.
sitefr at gmail dot com
26-Feb-2008 01:51
@ iraiscoming [AT] g m a i l [DOT] com

To encode chars lik "'", "\", "?", etc jou could also use the function rawurlencode();

 - R
rafael at phpit dot com dot br
25-Jan-2008 08:27
Looking forward to make an htmlentities that substitutes everything but tags, I've made a solution that goes against "olito24 at gmx dot de" proposed snippet...

Here it goes!

<?php

function htmlButTags($str) {
        // Take all the html entities
        $caracteres = get_html_translation_table(HTML_ENTITIES);
        // Find out the "tags" entities
        $remover = get_html_translation_table(HTML_SPECIALCHARS);
        // Spit out the tags entities from the original table
        $caracteres = array_diff($caracteres, $remover);
        // Translate the string....
        $str = strtr($str, $caracteres);
        // And that's it!
        return $str;
    }

?>

Any improvement will be much appreciated! :)
iraiscoming [AT] g m a i l [DOT] com
22-Jan-2008 01:29
As "realcj at g mail dt com" wrote in a comment for flashentities, here's an "extension" for reading wordpress cookies and using the addresses and e-mails in them:

<?php
function wp_entities($string, $encode = 0){

$a = (int) $encode;
$original = array("&","'",":","/","@");
$entities = array("%26","%27","%3A","%2F","%40");

if($a == 1)
    return str_replace($original, $entities, $string);
else
    return str_replace($entities, $original, $string);
}

?>
Just set the second argument to 1 (int) to make the function act the opposite way. :)
Hope it will be useful!
TKVLPUAIBSDB at spammotel dot com
14-Nov-2007 04:11
Yet another "help paste from MS Word" function. Characters from ISO-8859-1 charset are left in peace, while entities are built for non-standard characters from Windows CP1252.

function win1252toIso( $string ) {
    // These chars seem to be not contained
    // in php's CP1252 translation table
    static $extensions = array(
        142 => "&Zcaron;",
        158 => "&zcaron;"
    );
    // Go through string and decide char by char:
    // "leave as is or build entity?"
    $newStr = "";
    for( $i=0; $i < strlen( $string ); $i++ ) {
        $ord = ord( $string[$i] );
        if ( in_array( $ord, array_keys( $extensions ) ) ) {
            // build entity using extra translation table
            $newStr .= $extensions[$ord];
        }
        else {
            // build entity using php's translation table
            // or leave as is
            $newStr .= ( $ord > 127 && $ord < 160 ) ?
                htmlentities( $string[$i], ENT_NOQUOTES, "CP1252" )
                : $string[$i];
        }
    }
    return $newStr;
}
SR
15-Oct-2007 12:57
There's no sane reason to use htmlentities() instead of htmlspecialchars(). As long as you specify the charset of a page with a Content-Type meta in the head of a page (which you should ALWAYS do in the first place), escaping all characters is completely pointless and will only grow the size of your page. Only the special HTML characters (<, >, &, etc.) need to be escaped, which is exactly what htmlspecialchars() does.
marktpitman at gmail dot com
15-Oct-2007 07:21
I just thought I would add that if you're using the default charset, htmlentities will not correctly return the trademark ( ™ ) sign.

Instead it will return something like this: �

If you need the trademark symbol, use:

htmlentities( $html, ENT_QUOTES, "UTF-8" );
Anonymous Coward
08-Oct-2007 06:29
Another version of the xml special characters string conversion, this one also takes care of ascii chars in range 128 to 255

$asc2uni = Array();
for($i=128;$i<256;$i++){
  $asc2uni[chr($i)] = "&#x".dechex($i).";";   
}

function XMLStrFormat($str){
    global $asc2uni;
    $str = str_replace("&", "&amp;", $str);
    $str = str_replace("<", "&lt;", $str); 
    $str = str_replace(">", "&gt;", $str); 
    $str = str_replace("'", "&apos;", $str);  
    $str = str_replace("\"", "&quot;", $str); 
    $str = str_replace("\r", "", $str);
    $str = strtr($str,$asc2uni);
    return $str;
}
ferrettinico at gmail dot com
03-Oct-2007 09:13
Hi, from some machines (Mac for example), when submiting a form characters with accents makes the wrong encode.

For example: í -> &Atilde;&shy instead of &iacute;
halocastle at yahoo dot com
03-Sep-2007 02:03
Okay, so maybe this SHOULD be posted under Urlencode, but there's more talk of foiling XSS attacks here than there, so…

Be VERY careful validating submitted data not to miss something.  By that I mean EVERYTHING passed in the $_POST array, including keys (the names of the form fields themselves) is susceptible to XSS attacks.  Any hack can add whatever they want to your form and submit it to your script:

<input type="hidden" name="<script>alert('…the form_fields_NAMES can get you, too!');</script>" value="We all validate form_field_VALUES, but…">

Step one of course is to adopt a sensible naming convention for your form fields, to whit: name="always_lower_case" (underscores do NOT get encoded because they are valid URL characters).  So, you should never find a "%" in one of your form field NAMES.  Here's what I do:

foreach($_POST as $key => $val) {
  // scrubbing the field NAME...
  if(preg_match('/%/', urlencode($key)*)) die('FATAL::XSS hack attempt detected. Your IP has been logged.');
  // okay, got here, now scrubbing the field VALUE...
  [ scrub $val here by using htmlentities or a custom replacement function ];
  ...;
}

* %3Cscript%3Ealert%28%27%85the+form_fields_NAMES+can+get+you%...

P.S. Yes, remove the asterisk!
Ashus
27-Jun-2007 12:36
This should basically protect the mail addresses on webpages:

<?php

function InsertMail($mail)
    {
    if ($mail=='') return '';
    $mail = str_replace(array('@',':','.'), array('&#064;','&#058;','&#046;'), $mail);
    $mail = '<a href=mailto&#058;'.$mail.'>'.$mail.'</a>';
    $len = strlen($mail);
    $i=0;
    while($i<$len)
        {
        $c = mt_rand(1,4);
        $par[] = (substr($mail, $i, $c));
        $i += $c;
        }
    $join = implode('"+ "', $par);

    return '<script language=javascript>
    <!--
    document.write("'.$join.'")
    //-->
    </script>';
    }

echo InsertMail ('user@example.com');

?>

Prints a javascript, that joins a bunch of randomly long substrings (1-4) of hyperlink prefix mailto and email address, considering that the chars . : and @ are replaced by html entities. It should work just fine.
Justin
15-Jun-2007 09:21
In response to soapergem at gmail dot com 10-May-2006 02:14 - If any of you are attempting to use this or anything else to foil XSS attacks, test this or any other function out _first_ before you put it into a development environment.  To test out if you think your code will pass, just visit http://www.gnucitizen.org/xssdb/application.htm  for some potential attacks.  After doing this myself it is apparent that just simply using htmlspecialchars is sufficient.
D. Gasser
24-Apr-2007 10:40
When using UTF-8 as charset, you'll have to set UTF-8 in braces, otherwise the varaible is not recognized.
ghoffman at salientdigital dot com
03-Apr-2007 11:17
If you are looking for a comprehensive visual list of entities check here:
http://www.w3schools.com/tags/ref_entities.asp
q (dot) rendeiro (at) gmail (dot) com
07-Mar-2007 04:41
I've seen lots of functions to convert all the entities, but I needed to do a fulltext search in a db field that had named entities instead of numeric entities (edited by tinymce), so I searched the tinymce source and found a string with the value->entity mapping. So, i wrote the following function to encode the user's query with named entities.

The string I used is different of the original, because i didn't want to convert ' or ". The string is too long, so I had to cut it. To get the original check TinyMCE source and search for nbsp or other entity ;)

<?php

$entities_unmatched = explode(',', '160,nbsp,161,iexcl,162,cent, [...] ');
$even = 1;
foreach($entities_unmatched as $c) {
    if($even) {
        $ord = $c;
    } else {
        $entities_table[$ord] = $c;
    }
    $even = 1 - $even;
}

function encode_named_entities($str) {
    global $entities_table;
   
    $encoded_str = '';
    for($i = 0; $i < strlen($str); $i++) {
        $ent = @$entities_table[ord($str{$i})];
        if($ent) {
            $encoded_str .= "&$ent;";
        } else {
            $encoded_str .= $str{$i};
        }
    }
    return $encoded_str;
}

?>
realcj at g mail dt com
06-Nov-2006 10:41
If you are building a loadvars page for Flash and have problems with special chars such as " & ", " ' " etc, you should escape them for flash:

Try trace(escape("&")); in flash' actionscript to see the escape code for &;

% = %25
& = %26
' = %27

<?php
function flashentities($string){
return str_replace(array("&","'"),array("%26","%27"),$string);
}
?>

Those are the two that concerned me. YMMV.
chuck at broker[remove]bin dot com
31-Oct-2006 05:33
/*
replaces everything but
alphanumeric
tab
newline
carriage return
*/
function allhtmlentities($string,$decode_first=true) {
    // this is to ensure that any entities already coded are not "messed up"
    if($decode_first) $string = html_entity_decode($string);
    // "encode"
    return preg_replace(
'/([^\x09\x0A\x0D\x20-\x7F]|[\x21-\x2F]|[\x3A-\x40]|[\x5B-\x60])/e'
           , '"&#".ord("$0").";"', $string);
}
eric.wallet at yahoo.fr
26-Sep-2006 04:57
function htmlnumericentities($str){
  return preg_replace('/[^!-%\x27-;=?-~ ]/e', '"&#".ord("$0").chr(59)', $str);
}

function numericentitieshtml($str){
  return utf8_encode(preg_replace('/&#(\d+);/e', 'chr(str_replace(";","",str_replace("&#","","$0")))', $str));
}

echo (htmlnumericentities ("Ceci est un test : & é $ à ç <"));
echo ("<br/>\n");
echo (numericentitieshtml (htmlnumericentities ("Ceci est un test : & é $ à ç <")));

Output is :
Ceci est un test : &#38; &#233; $ &#224; &#231; &#60;<br/>
Ceci est un test : & é $ à ç <

First method convert characters to decimal values.
Second will reverse the problem !!!
lorenzo masetti at libero it
08-Aug-2006 08:44
i think I found a bug in  makeSafeEntities procedure. I don't know why but if the string has a special charachter as the last one (e.g. 'liberté') the result will be truncated ('libert')
I solved by adding and  taking a way a blank at the  end  of the string ,  it is not the most elegant solution but it works
This is the part that I changed in the original code that is at http://www.prolifique.com/entities.php.txt

<?php
function makeSafeEntities($str, $convertTags = 0, $encoding = "") {
 if (is_array($arrOutput = $str)) {
   foreach (array_keys($arrOutput) as $key)
     $arrOutput[$key] = makeSafeEntities($arrOutput[$key],$encoding);
   return $arrOutput;
   }
 else if (!empty($str)) {
     $str .= " ";
   $str = makeUTF8($str,$encoding);
   $str = mb_convert_encoding($str,"HTML-ENTITIES","UTF-8");
   $str = makeAmpersandEntities($str);
   if ($convertTags)
     $str = makeTagEntities($str);
   $str = correctIllegalEntities($str);
   return substr($str, 0, strlen($str)-1);
   }
 }
?>
daviscabral[arroba]gmail[ponto]com
28-Jul-2006 12:52
unhtmlentities for all entities:

<?php

function unhtmlentities ($string) {
   $trans_tbl1 = get_html_translation_table (HTML_ENTITIES);
   foreach ( $trans_tbl1 as $ascii => $htmlentitie ) {
        $trans_tbl2[$ascii] = '&#'.ord($ascii).';';
   }
   $trans_tbl1 = array_flip ($trans_tbl1);
   $trans_tbl2 = array_flip ($trans_tbl2);
   return strtr (strtr ($string, $trans_tbl1), $trans_tbl2);
}

?>
info at pirandot dot de
22-Jul-2006 07:14
Unfortunately, there are differences between what is shown in the preview window and what is shown on the web site; thus, the extreme number of backslashes in my former note.

The corrected note:

The data returned by a text input field is ready to be used in a data base query when enclosed in single quotes, e.g.
<?php
   mysql_query ("SELECT * FROM Article WHERE id = '$data'");
?>
But you will get problems when writing back this data into the input field's value,
<?php
   echo "<input name='data' type='text' value='$data'>";
?>
because hmtl codes would be interpreted and escape sequences would cause strange output.

The following function may help:
<?php
function deescape ($s, $charset='UTF-8')
{
   //  don't interpret html codes and don't convert quotes
   $s  =  htmlentities ($s, ENT_NOQUOTES, $charset);

   //  delete the inserted backslashes except those for protecting single quotes
   $s  =  preg_replace ("/\\\\([^'])/e", '"&#" . ord("$1") . ";"', $s);

   //  delete the backslashes inserted for protecting single quotes
   $s  =  str_replace ("\\'", "&#" . ord ("'") . ";", $s);

   return  $s;
}
?>
Try some input like:  a'b"c\d\'e\"f\\g&x#27;h  to test ...
soapergem at gmail dot com
10-May-2006 11:14
A quick revision to my last comment. For some reason, leaving the control characters in the safe range seemed to screw things up. So instead, using this function will do what everybody else here is trying to do, but it will do so in a single line:

<?php
$text = preg_replace('/[^\x09\x0A\x0D\x20-\x7F]/e', '"&#".ord($0).";"', $text);
?>
cameron at prolifique dot com
10-May-2006 11:01
I've been asked why I assembled such intricate functions to convert to entities when I could use a very simple solution (like the one offered by soapergem below). The biggest reason is that the PHP htmlentities function and most of the other solutions listed below go haywire on multi-byte strings.

In addition, the entire range of numbered entities from &#129; through &#159; are invalid characters, and should not be used (as noted by mail at britlinks dot com below). Most htmlentity functions also do not convert ampersands or pointy brackets (<>) to entities. The ones that do often reconvert existing entities (&amp; becomes &amp;amp;).
cameron at prolifique dot com
05-May-2006 05:02
I've been dissatisfied with all the solutions I've yet seen for converting text into html entities, which all seem to have some drawback or another. So I wrote my own, borrowing heavily from other code posted on this site.

http://www.prolifique.com/entities.php.txt

makeSafeEntities() should take any text, convert it from the specified charset into UTF-8, then replace all inappropriate characters with appropriate (and legal) character entities, returning generic ISO-8859 HTML text. Should NOT reconvert any entities already in the text.

makeAllEntities() does the same, but converts the entire string to entities. Useful for obscuring email addresses (in a lame but nonetheless somewhat effective way).

Suggestions for improvement welcome!
soapergem at gmail dot com
29-Apr-2006 11:53
Here's another version of that "allhtmlentities" function that an anonymous user posted in the last comment, only this one would be significantly more efficient. Again, this would convert anything that has an ASCII value higher than 127.

<?php
function allhtmlentities($string)
{
    return preg_replace('/[^\x00-\x7F]/e', '"&#".ord("$0").";"', $string);
}
?>
anonymous
26-Apr-2006 12:38
This function will encode anything that is non Standard ASCII (that is, that is above #127 in the ascii table)

// allhtmlentities : mainly based on "chars_encode()"  by Tim Burgan <timburgan@gmail.com> [http://www.php.net/htmlentities]
function allhtmlentities($string) {
    if ( strlen($string) == 0 )
        return $string;
    $result = '';
    $string = htmlentities($string, HTML_ENTITIES);
    $string = preg_split("//", $string, -1, PREG_SPLIT_NO_EMPTY);
    $ord = 0;
    for ( $i = 0; $i < count($string); $i++ ) {
        $ord = ord($string[$i]);
        if ( $ord > 127 ) {
            $string[$i] = '&#' . $ord . ';';
        }
    }
    return implode('',$string);
}
eion at bigfoot dot com
20-Feb-2006 04:54
many people below talk about using
<?php
    mb_convert_encode($s,'HTML-ENTITIES','UTF-8');
?>
to convert non-ascii code into html-readable stuff.  Due to my webserver being out of my control, I was unable to set the database character set, and whenever PHP made a copy of my $s variable that it had pulled out of the database, it would convert it to nasty latin1 automatically and not leave it in it's beautiful UTF-8 glory.

So [insert korean characters here] turned into ?????.

I found myself needing to pass by reference (which of course is deprecated/nonexistent in recent versions of PHP)
so instead of
<?php
    mb_convert_encode(&$s,'HTML-ENTITIES','UTF-8');
?>
which worked perfectly until I upgraded, so I had to use
<?php
    call_user_func_array('mb_convert_encoding', array(&$s,'HTML-ENTITIES','UTF-8'));
?>

Hope it helps someone else out
Bartek
31-Jan-2006 02:06
I use this function to convert imput from MS Word into html  (ascii) compatible output. I hope it would work also for you.

I have enabled magic_quotes on my server so maybe you won't need stripslashes and addslashes.
I've also noticed that Opera 8.51 browses behaves somehow different from IE 6 and Firefox 1.5. I haven't check this functions with other browsers.

<?php
function convert_word_to_ascii($string)
{
    $string = stripslashes($string);
   
    if ( stristr($_SERVER['HTTP_USER_AGENT'], "Opera") )
    $search = array('&#8216;',
                chr(96),
                '&#8217;',
                '&#8222;',
                '&#8221;',
                '&#8220;',
                '&#8230;',
                '&#8211;');
                           
    if ( stristr($_SERVER['HTTP_USER_AGENT'], "Firefox") || stristr($_SERVER['HTTP_USER_AGENT'], "MSIE") )
    $search = array(chr(145),
                chr(146),
                chr(96),
                chr(132),
                chr(147),
                chr(148),
                chr(133),
                chr(150));
                           
    $replace = array(    "'",
                "'",
                "'",
                '"',
                '"',
                '"',
                '...',
                '-');

    $new_string = str_replace($search, $replace, $string);
    return addslashes($new_string);
};
?>
23-Jan-2006 05:20
Please, don't use htmlentities to avoid XSS! Htmlspecialchars is enough!

If you don't specify the encoding, Latin1 will be used, so there is a problem if someone wants to use your software in a non-English environment.
mailing at jcn50 dot com
20-Jan-2006 10:25
Convert any language (Japanese, French, Chinese, Russian, etc...) to unicode HTML entities like &#XXXX;
In one line!

$new=mb_convert_encoding($s,"HTML-ENTITIES","auto");

where $s is your string (may be a FORM submitted one).

Enjoy~
edo at edwaa dot com
17-Nov-2005 08:48
A version of the xml entities function below. This one replaces the "prime" character () with which I had difficulties.

// XML Entity Mandatory Escape Characters
function xmlentities($string) {
   return str_replace ( array ( '&', '"', "'", '<', '>', '' ), array ( '&amp;' , '&quot;', '&apos;' , '&lt;' , '&gt;', '&apos;' ), $string );
}
info at bleed dot ws
14-Oct-2005 10:42
here the centralized version of htmlentities() for multibyte.

<?php
function mb_htmlentities($string)
{
    $string = htmlentities($string, ENT_COMPAT, mb_internal_encoding());
    return $string;
}

?>
fanfatal at fanfatal dot pl
28-Aug-2005 02:28
I wrote usefull function which is support iso-8859-2 encoding with htmlentities function ;]

<?php
/*
 *    Function htmlentities which support iso-8859-2
 *
 *    @param string
 *    @return string
 *    @author FanFataL
 */
function htmlentities_iso88592($string='') {
    $pl_iso = array('&ecirc;', '&oacute;', '&plusmn;', '&para;', '&sup3;', '&iquest;', '&frac14;', '&aelig;', '&ntilde;', '&Ecirc;', '&Oacute;', '&iexcl;', '&brvbar;', '&pound;', '&not;', '&macr;', '&AElig;', '&Ntilde;');   
    $entitles = get_html_translation_table(HTML_ENTITIES);
    $entitles = array_diff($entitles, $pl_iso);
    return strtr($string, $entitles);
}
?>

Greatings ;-)
...
webmaster at swirldrop dot com
26-Jul-2005 11:45
To replace any characters in a string that could be 'dangerous' to put in an HTML/XML file with their numeric entities (e.g. &#233 for [e acute]), you can use the following function:

function htmlnumericentities($str){
  return preg_replace('/[^!-%\x27-;=?-~ ]/e', '"&#".ord("$0").chr(59)', $str);
};//EoFn htmlnumericentities

To change any normal entities (e.g. &euro;) to numerical entities call:
$str = htmlnumericalentities(html_entity_decode($str));
rbotzer at yahoo dot com
19-Jul-2005 02:10
The existance of html entities such as &quot; inside an xml node causes most xml parsers to throw an error.  The following function cleans an input string by converting html entities to valid unicode entities.

<?php

function htmlentities2unicodeentities ($input) {
  $htmlEntities = array_values (get_html_translation_table (HTML_ENTITIES, ENT_QUOTES));
  $entitiesDecoded = array_keys   (get_html_translation_table (HTML_ENTITIES, ENT_QUOTES));
  $num = count ($entitiesDecoded);
  for ($u = 0; $u < $num; $u++) {
    $utf8Entities[$u] = '&#'.ord($entitiesDecoded[$u]).';';
  }
  return str_replace ($htmlEntities, $utf8Entities, $input);
}
?>

So, an input of
Copyrights &copy; make &quot;me&quot; grin &reg;

outputs
Copyrights &#169; make &#34;me&#34; grin &#174;
send at mail dot 2aj dot net
14-Jul-2005 10:03
If you are programming XML documents and are using the htmlentities function, then performing a  str_replace on ' into &apos; to set mandatory escape characters you can use this simple function instead.

This function, xmlentities, is basically the XML parsing equivalent of htmlentities, with fewer options than its HTML counterpart:

<?php
// XML Entity Mandatory Escape Characters
function xmlentities ( $string )
{
    return str_replace ( array ( '&', '"', "'", '<', '>' ), array ( '&amp;' , '&quot;', '&apos;' , '&lt;' , '&gt;' ), $string );
}
?>

Example:

<?php
function xmlentities($string)
{
    return str_replace ( array ( '&', '"', "'", '<', '>' ), array ( '&amp;' , '&quot;', '&apos;' , '&lt;' , '&gt;' ), $string );
}

echo xmlentities("If you don't use these mandatory escape characters <tags> between </tags>, XML will \"eXtensively\" & \"implicitly\" give you errors.");
?>

Produces...
If you don&apos;t use these mandatory escape characters &lt;tags&gt; between &lt;/tags&gt;, XML will &quot;eXtensively&quot; &amp; &quot;implicitly&quot; give you errors.
penfield888 at yahoo dot com
01-Feb-2005 09:40
This is a followup to the older note by mirrorball_girl (5 Jan 2003) for those who may follow.

Rather than making an exception for the en-dash (#150) and translating it to a hyphen, you could use the &#8211; unicode en-dash entity (assuming that you are serving up your pages as UTF-8 or some such encoding.

Also, the whole thing can be done better with mb_detect_order, mb_detect_encoding and mb_convert_encoding if all you want to do is serve up a web page (if you need to convert to pure ASCII, that's another issue). You need to have multi-byte support enabled on your PHP server.

Basically, the problem is with older MS programs that use Windows-1252 for their encoding, so all you really need to do is
- detect for Win-1252
- if present, convert to UTF-8
- serve up your pages as UTF-8

See the manual on Multibyte String Functions for more information.
root at joe-linux.NOSPAM.org
27-Jan-2005 02:48
It may come to you as a surprise, but i've noticed that in Firefox (as of 1.0), the text presented in "View selection source" is not the same as "View page source"; Il you want to see the REAL result of htmlentities() you should look at the entire source;

almost become mad before i discover this :)
marques at displague dot com
24-Jan-2005 10:01
htmlEncodeText (below) needs a small tweak, the dash needs to be made literal to get picked up in cases like '<a href="blah-blah.php">'.  I have been using this function to parse my postgresql database calls since I have alot of unicode data and I don't want HTML data to be neutered (via htmlentities()).

<?php
function htmlEncodeText ($string)
{
  $pattern = '<([a-zA-Z0-9\.\, "\'_\/\-\+~=;:\(\)?&#%![\]@]+)>';
  preg_match_all ('/' . $pattern . '/', $string, $tagMatches, PREG_SET_ORDER);
  $textMatches = preg_split ('/' . $pattern . '/', $string);

  foreach ($textMatches as $key => $value) {
   $textMatches [$key] = htmlentities ($value);
  }

  for ($i = 0; $i < count ($textMatches); $i ++) {
   $textMatches [$i] = $textMatches [$i] . $tagMatches [$i] [0];
  }

  return implode ($textMatches);
}
?>

--Editor note: Combined some corrections to the regex pattern, thanks to fabian dot lange at web dot de, hammertscrew at veryweb dot com, webmaster AT scholesmafia DOT co DOT uk, thomas AT cosifan DOT de and marques at displague dot com---
dumb at coder dot com
17-Jan-2005 04:22
/*
15Jan05

Within <textarea>, Browsers auto render & display certain "HTML Entities" and "HTML Entity Codes" as characters:
&lt; shows as <    --    &amp; shows as &    --    etc.

Browsers also auto change any "HTML Entity Codes" entered in a <textarea> into the resultant display characters BEFORE UPLOADING.  There's no way to change this, making it difficult to edit html in a <textarea>

"HTML Entity Codes" (ie, use of &#60 to represent "<", &#38 to represent "&" &#160 to represent "&nbsp;") can be used instead.  Therefore, we need to "HTML-Entitize" the data for display, which changes the raw/displayed characters into their HTML Entity Code equivalents before being shown in a <textarea>.

how would I get a textarea to contain "&lt;" as a literal string of characters and not have it display a "<"
&amp;lt; is indeed the correct way of doing that. And if you wanted to display that, you'd need to use &amp;amp;lt;'. That's just how HTML entities work.

htmlspecialchars() is a subset of htmlentities()
the reverse (ie, changing html entity codes into displayed characters, is done w/ html_entity_decode()

google on ns_quotehtml and see http://aolserver.com/docs/tcl/ns_quotehtml.html
see also http://www.htmlhelp.com/reference/html40/entities/
*/
Duane
09-Jan-2005 05:34
I found using:

preg_replace("/&(?![A-Za-z]{0,4}\w{2,3};|#[0-9]{2,5};)/",
"&#38;",strtr($string, $trans));

didn't trap hex values (such as &#x7684;), so instead I ended
up using:

preg_replace("/&(?![A-Za-z]{0,4}\w{2,3};|#[x0-9a-f]{2,6};)/",
"&#38;", strtr($string, $trans));
olito24 at gmx dot de
13-Dec-2004 04:17
a function to encode everything but html tags. pattern improvement is much appreciated!

function htmlEncodeText ($string)
{
  $pattern = '<([a-zA-Z0-9\. "\'_\/-=;\(\)?&#%]+)>';
  preg_match_all ('/' . $pattern . '/', $string, $tagMatches, PREG_SET_ORDER);
  $textMatches = preg_split ('/' . $pattern . '/', $string);

  foreach ($textMatches as $key => $value) {
    $textMatches [$key] = htmlentities ($value);
  }

  for ($i = 0; $i < count ($textMatches); $i ++) {
    $textMatches [$i] = $textMatches [$i] . $tagMatches [$i] [0];
  }

  return implode ($textMatches);
}
duke at redump dot de
01-Nov-2004 06:44
The function xmlentities works great, but there can be up to 5 numbers after the &# string. See this for example:

&#12505;&#12540;&#12473;&#12508;&#12540;
&#12523;&#12473;&#12479;&#12540;&#12474;2

This is a valid (wrapped) japanese string. To successfully use it with xmlentities, you need to replace

return preg_replace("/&(?![A-Za-z]{0,4}\w{2,3};|#[0-9]{2,3};)/","&#38;" , strtr($string, $trans));

with

return preg_replace("/&(?![A-Za-z]{0,4}\w{2,3};|#[0-9]{2,5};)/","&#38;" , strtr($string, $trans));

(3 to 5).

Duke
tmp1000 at fastmail dot deleteme dot fm
22-Oct-2004 10:07
Regarding the two great function posted by pinkpather and webwurst;  one to encode xml entities, the other to encode only the entities of a string not already encoded.  I've combined these two.  And IMHO made a small improvement by making the translation table static:

<?php
function xmlentities($string, $quote_style=ENT_QUOTES)
{
    static $trans;
    if (!isset($trans)) {
        $trans = get_html_translation_table(HTML_ENTITIES, $quote_style);
        foreach ($trans as $key => $value)
            $trans[$key] = '&#'.ord($key).';';
        // dont translate the '&' in case it is part of &xxx;
        $trans[chr(38)] = '&';
    }
    // after the initial translation, _do_ map standalone '&' into '&#38;'
    return preg_replace("/&(?![A-Za-z]{0,4}\w{2,3};|#[0-9]{2,3};)/","&#38;" , strtr($string, $trans));
}
?>

Here's the snippet of code I'm testing with:

<?php
echo "<p>Testing xmlentities...</p>";
$strings[] = "No entities here.";
$strings[] = "<b>bold</b>";
$strings[] = "Got style? Try K & R.";
echo "<ul>";
foreach ($strings as $string) {
    echo "<li>Original string: ".htmlentities($string)."</li>\n";
    echo "<li>Encoded once: ".htmlentities(xmlentities($string))."</li>\n";
    echo "<li>Encoded twice: ".htmlentities(xmlentities(xmlentities($string)))."</li>\n";
   
}
echo "</ul>";

?>
Miguel (miguel at sigmanet dot com dot br)
20-Oct-2004 08:43
This is a simple script that I'm using to encode and decode values from a form. Save it with the name that you wish.

<?php

/*  When you call anyone of the two functions, set the $_str
     variable to the string that you want to encode or decode */

/* This function encodes the string.
    You can safetly use this function to save its result in a
    database. It eliminates any space in the beginning ou end
    of the string, HTML and PHP tags, and encode any special
    char to the usual HTML entities (&[...];), eliminating the
    possibility of bugs in inserting data on a table */
function encodeText($_str) {
  $_str = strip_tags($_str);
  $_str = trim($_str);
  $_str = htmlentities($_str);
  $_str = str_replace("\r\n", "#BR#", $_str);
  return($_str);
}

/* This function decodes the string.
    If you are showing the string in the body of a page, you
    can set the $_form variable to "false", and the function will
    use the "BR" tag to the new lines. But, if you need to show
    the string in a textarea, text or other input types of a form
    set the $_form variable to "true", then the function will use
    the "\r\n" to the new lines */
function decodeText($_str, $_form) {
  $trans_tbl = get_html_translation_table (HTML_ENTITIES);
  $trans_tbl = array_flip ($trans_tbl);
  $_str      = strtr($_str, $trans_tbl);
  if ($_form) {
    $_nl = "\r\n";
  } else {
    $_nl = "<br>";
  }
  $_str      = str_replace("#BR#", "$_nl", $_str);
  return($_str);
}

?>
roland dot swingler at nospam dot transversal dot com
30-Sep-2004 08:39
You don't need these custom conversion functions.

This function will only work for the first 128 ascii characters if no character set is specified.  If you specify the character set in an http header:

<?php
header('Content-type: text/html; charset=utf-8');

htmlentities('string to be encoded', ENT_QUOTES, 'utf-8');
?>

then it will work for all html entities.  It outputs the named rather than the numerical entities, but html_entity_decode() will decode both numerical and textual entities (it will treat &#8364; and &euro; as the same).

BTW, if you are dealing with form submitted data, it is a good idea to add the accept-charset="character set" attribute
to the form as well.
cd at NOSPAM dot deluxe dot cd
19-Sep-2004 09:47
allthough it is much more complex than this, please note that if you're using xhtml the character encoding you specify within your document is "associated" with the encoding used by php.

e.g.:

<?xml version="1.0" encoding="..."?>

may also assess the manner form data is submitted. as it is prepared before sending it does not matter whether it is post or get.

to give you something stoutly have a look at mozilla firefox (0.9.3) where submitting form data...

<?xml version="1.0" encoding="ISO-8859-1"?>

...converts to %E4

<?xml version="1.0" encoding="UTF-8"?>

...converts to %C3%A4

or at internet explorer (6.0) where encoding is ignored while submit but default values of an input field let you recognize the same thing.

this may confuse you getting the desired &auml; afterwards.
porge
30-Aug-2004 08:09
Thanks attila at roughdot dot com, however I changed this to :

"/&(?![A-Za-z]{0,4}\w{2,3};|#[0-9]{2,4};|#x[0-9a-fA-F]{2,4};)/"

in order to also to match hex-coded entities.
attila at roughdot dot com
04-Aug-2004 10:25
Thx for that function, pinkpanther at swissonline dot ch, though the number of digits after the '#' can be 4, not 3.
I bumped into this when struggeling with the euro sign (&#8364;).

function htmlentities2( $myHTML)
{
    $translation_table = get_html_translation_table( HTML_ENTITIES, ENT_QUOTES);
    $translation_table[chr( 38)] = '&';
    return preg_replace( "/&(?![A-Za-z]{0,4}\w{2,3};|#[0-9]{2,4};)/", "&amp;" , strtr( $myHTML, $translation_table));
}
m227 at poczta dot onet dot pl
26-May-2004 03:00
// tested with PHP 4.3.4, Apache 1.29
// function works like original htmlentities
// but preserves Polish characters encoded in CP-1250
// (Windows code page) from false conversion

// m227@poczta.onet.pl, 2004

function htmlentities1250($str)
{
    // four chars does not need any conversion
    // s` (9c), z` (9f), Z` (8f), S` (8c)
    $trans = array(       
        "&sup3;"  => "\xb3", //  "l-"
        "&sup1;"  => "\xb9", //  "a,"
        "&ecirc;" => "\xea", //  "e,"
        "&aelig;" => "\xe6", //  "c`"
        "&ntilde;"=> "\xf1", //  "n`"                                       
        "&iquest;"=> "\xbf", //  "z."
        "&yen;"   => "\xa5", //  "A,"
        "&AElig;" => "\xc6", //  "C`"
        "&macr;"  => "\xaf", //  "Z."
        "&Ecirc;" => "\xca", //  "E,"
        "&oacute;"=> "\xf3", //  "o`"
        "&Oacute;"=> "\xd3", //  "O`"
        "&pound;" => "\xa3", //  "L-"
        "&Ntilde;"=> "\xd1"  //  "N`"
    );
    return strtr(htmlentities($str), $trans);
}
mail at britlinks dot com
19-May-2004 09:27
similar to cedric at shift-zone dot be's function, this 'cleans up' text from MS Word, and other non-alphanumeric characters to their valid [X]HTML counterparts

<?php
// strips slashes, and converts special characters to HTML equivalents for string defined in $var
function htmlfriendly($var,$nl2br = false){
    $chars = array(
        128 => '&#8364;',
        130 => '&#8218;',
        131 => '&#402;',
        132 => '&#8222;',
        133 => '&#8230;',
        134 => '&#8224;',
        135 => '&#8225;',
        136 => '&#710;',
        137 => '&#8240;',
        138 => '&#352;',
        139 => '&#8249;',
        140 => '&#338;',
        142 => '&#381;',
        145 => '&#8216;',
        146 => '&#8217;',
        147 => '&#8220;',
        148 => '&#8221;',
        149 => '&#8226;',
        150 => '&#8211;',
        151 => '&#8212;',
        152 => '&#732;',
        153 => '&#8482;',
        154 => '&#353;',
        155 => '&#8250;',
        156 => </