PHP

An in depth analysis of php htmlspecialchars of and shtmlspecialchars of functions


Definition and usage The htmlspecialchars() function converts 1 of the predefined characters to HTML entities.

The predefined characters are: • & (and sign) become & amp; The & # 8226;” (double quotes) becomes & quot; The & # 8226; ‘(single quote) becomes & #039; • < (less than) become & lt; • > (greater than) become & gt; grammar htmlspecialchars(string,quotestyle,character-set)

parameter describe string A necessity. Specifies the string to be converted. quotestyle

Optional. Specifies how to encode single and double quotes.

ENT_COMPAT - Default. Encode only double quotes. ENT_QUOTES - encodes double and single quotes. ENT_NOQUOTES - does not encode any quotes. character-set

Optional. String value, specifying the character set to be used.

ISO-8859-1 - Default. Western Europe. ISO-8859-15 - Western Europe (added Euro symbols and French and Finnish letters). UTF-8-ASCII is compatible with multi-byte 8-bit Unicode cp866-DOS Special Cyrillic Character Set cp1251-Windows Special Cyrillic Character Set cp 1252-Windows Special Western European Character set KOI8 R - Russian GB2312 - Simplified Chinese character Set, National Standard character Set BIG5 - Traditional Chinese BIG5-HKSCS-Big5 Hong Kong Extension Shift_JIS - Japanese EUC JP - Japanese Hints and comments Tip: Unrecognized character sets will be ignored and replaced by ISO-8859-1. example

<html>
    <body>
    <?php
        $str = "John & 'Adams'";
        echo htmlspecialchars($str, ENT_COMPAT);
        echo "<br />";
        echo htmlspecialchars($str, ENT_QUOTES);
        echo "<br />";
        echo htmlspecialchars($str, ENT_NOQUOTES);
    ?>
    </body>
</html>

Browser output:

John & 'Adams'
John & 'Adams'
John & 'Adams'

If you look at the source code in a browser, you’ll see these HTML:

<html>
    <body>
    John &amp; 'Adams'<br />John &amp; &#039;Adams&#039;<br />John &amp; 'Adams'    </body>
</html>

======================================================================= The shtmlspecialchars() function is the opposite