htmlspecialchars_decode

(PHP 5 >= 5.1.0, PHP 7, PHP 8)

htmlspecialchars_decode — Converte entidades especiais HTML de volta para caracteres

Descrição

htmlspecialchars_decode(string $string, int $flags = ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401): string

Esta função é oposta a htmlspecialchars(). Ela converte de volta entidade especiais HTML em caracteres.

As entidades convertidas são: &, " (quando ENT_NOQUOTES não estiver definida), ' (quando ENT_QUOTES estiver definida), < e >.

Parâmetros

string

A string a ser decodificada.

flags

Uma máscara de bits de uma ou mais das opções a seguir, que especificam como lidar com aspas e que tipos de documentos são usados. O padrão é ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401.

**Constantes disponíveis para `flags`**
Nome da Constante	Descrição
`ENT_COMPAT`	Converte aspas duplas e não converte aspas simples.
`ENT_QUOTES`	Converte tanto aspas duplas quanto simples.
`ENT_NOQUOTES`	Não converte aspas duplas ou simples.
`ENT_SUBSTITUTE`	Substitui sequências de unidade de código inválidas com um Caractere de Substituição Unicode U+FFFD (UTF-8) ou � ao invés de retornar uma string vazia.
`ENT_HTML401`	Lida com o código como HTML 4.01.
`ENT_XML1`	Lida com o código como XML 1.
`ENT_XHTML`	Lida com o código como XHTML.
`ENT_HTML5`	Lida com o código como HTML 5.

Valor Retornado

Retorna a string decodificada.

Registro de Alterações

Versão	Descrição
8.1.0	O padrão de `flags` mudou de `ENT_COMPAT` para `ENT_QUOTES` \| `ENT_SUBSTITUTE` \| `ENT_HTML401`.

Exemplos

Exemplo #1 Um exemplo de htmlspecialchars_decode()

<?php
$str = "<p>this -&gt; &quot;</p>\n";

echo htmlspecialchars_decode($str);

// observe que aqui as aspas não são convertidas
echo htmlspecialchars_decode($str, ENT_NOQUOTES);
?>

O exemplo acima produzirá:

<p>this -> "</p>
<p>this -> &quot;</p>

Veja Também

htmlspecialchars() - Converte caracteres especiais para entidades HTML
html_entity_decode() - Converte entidades HTML aos seus caracteres correspondentes
get_html_translation_table() - Retorna a tabela de tradução usada por htmlspecialchars e htmlentities

Improve This Page

Learn How To Improve This Page • Submit a Pull Request • Report a Bug

＋add a note

User Contributed Notes 8 notes

down

thomas at xci[ignore_this]teit dot commm ¶

16 years ago

The example for "htmlspecialchars_decode()" below sadly does not work for all PHP4 versions.

Quote from the PHP manual:
"get_html_translation_table() will return the translation table that is used internally for htmlspecialchars() and htmlentities()."

But it does NOT! At least not for PHP version 4.4.2.
This was already reported in a bug report (http://bugs.php.net/bug.php?id=25927), but it was marked as BOGUS.

Proof:
  Code:
--------------------
<?php
    var_dump(get_html_translation_table(HTML_SPECIALCHARS,ENT_QUOTES));
    var_dump(htmlspecialchars('\'',ENT_QUOTES));
?>
--------------------

  Output:
--------------------
array
  '"' => '&quot;'
  ''' => '&#39;'
  '<' => '&lt;'
  '>' => '&gt;'
  '&' => '&amp;'

'&#039;'
--------------------

This comment now is not to report this bug again (though I really believe it is one), but to complete the example and warn people of this pitfall.

To make sure your htmlspecialchars_decode fake for PHP4 works, you should do something like this:

<?php
    function htmlspecialchars_decode($string,$style=ENT_COMPAT)
    {
        $translation = array_flip(get_html_translation_table(HTML_SPECIALCHARS,$style));
        if($style === ENT_QUOTES){ $translation['&#039;'] = '\''; }
        return strtr($string,$translation);
    }
?>

Br, Thomas

down

Anonymous ¶

17 years ago

This should be the best way to do it.
(Reposted because the other one seems a bit slower and because those who used the code under called it htmlspecialchars_decode_php4)

<?php

if ( !function_exists('htmlspecialchars_decode') )
{
    function htmlspecialchars_decode($text)
    {
        return strtr($text, array_flip(get_html_translation_table(HTML_SPECIALCHARS)));
    }
}

?>

down

-2

or-k at or-k dot com ¶

18 years ago

that works also with &auml; and &quot; and so on.
get_html_translation_table(HTML_ENTITIES) => offers more characters than HTML_SPECIALCHARS

function htmlspecialchars_decode_PHP4($uSTR)
{
 return strtr($uSTR, array_flip(get_html_translation_table(HTML_ENTITIES, ENT_QUOTES)));
}

down

-6

pinkgothic at gmail dot com ¶

14 years ago

Keep in mind that you should never trust user input - particularly for "mixed-bag" input containing a combination of plain text and markup or scripting code.



Why?



Well, consider someone sending '&amp;<script>alert('XSS');</script>' to your PHP script:



<?php

$var = "&amp;<script>alert('XSS');</script>";

$var = (htmlspecialchars_decode($var) == $var) ? htmlspecialchars($var) : $var;

echo $var;

?>



Since '&amp;' decodes into '&', (htmlspecialchars_decode($var) == $var) will be -false-, thus returning $var without that it's escaped. In consequence, the script-tags are untouched, and you've just opened yourself to XSS.



There is, unfortunately, no reliable way to determine whether HTML is escaped or not that does not come with this caveat that I know of. Rather than try and catch the case 'I've already encoded this', you are better off avoiding double-escaping by simply escaping the HTML as close to the actual output as you can muster, e.g. in the view in an MVC development structure.

down

-9

geoffers@gmail ¶

19 years ago

[Update of previous note, having noticed I forgot to put in quote style]

PHP4 Compatible function:

<?php

function htmlspecialchars_decode_php4 ($str, $quote_style = ENT_COMPAT) {
    return strtr($str, array_flip(get_html_translation_table(HTML_SPECIALCHARS, $quote_style)));
}

?>

down

-12

benharold at mac dot com ¶

15 years ago

If you use `htmlspecialchars()` to change things like the ampersand (&) into it's HTML equivalent (&amp;), you might run into a situation where you mistakenly pass the same string to the function twice, resulting in things appearing on your website like, as I call it, the ampersanded amp; "&amp;". Clearly nobody want's "&amp;" on his or her web page where there is supposed to be just an ampersand. Here's a quick and easy trick to make sure this doesn't happen:

<?php

$var = "This is a string that could be passed to htmlspecialchars multiple times.";

if (htmlspecialchars_decode($var) == $var) {
    $var = htmlspecialchars($var);
}

echo $var;

?>

Now, if your dealing with text that is a mixed bag (has HTML entities and non-HTML entities) you're on your own.

down

-11

geoffers at gmail dot com ¶

19 years ago

For PHP4 Compatibility:

<?php

function htmlspecialchars_decode_php4 ($str) {
    return strtr($str, array_flip(get_html_translation_table(HTML_SPECIALCHARS)));
}

?>

down

-14

benharold at mac dot com ¶

15 years ago

or of course:

<?php

$var = "Blue & yellow make green.";

$var = (htmlspecialchars_decode($var) == $var) ? htmlspecialchars($var) : $var;
echo $var; // outputs Blue &amp; yellow make green.

// you can do it a bunch of times, it still won't screw you!

$var = (htmlspecialchars_decode($var) == $var) ? htmlspecialchars($var) : $var;
$var = (htmlspecialchars_decode($var) == $var) ? htmlspecialchars($var) : $var;
echo $var; // still outputs Blue &amp; yellow make green.

?>

Put it in a function. Add it to the method of some abstract data class.

＋add a note