How can I safely output HTML from a PHP program?

Question

When doing this job in PHP, one may meet this kind of issue:

<span title="<?php echo $variable;?>">...

The problem is that if $variable contains double quotes, it should be changed to \".

And that's not the whole story yet:

<span title='<?php echo $variable;?>'>...

In this case, we need to change single quotes to \', but leave double quotes as is.

In addition, variable values may contain angle brackets, < and >, that will interfere with HTML.

So how can we safely escape output for HTML?

Dominic Rodger · Accepted Answer · 2013-09-26 14:44:55Z

112

You always want to HTML-encode things inside HTML attributes, which you can do with htmlspecialchars:

<span title="<?php echo htmlspecialchars($variable); ?>">

You probably want to set the second parameter ($quote_style) to ENT_QUOTES.

The only potential risk is that $variable may already be encoded, so you may want to set the last parameter ($double_encode) to false.

edited Sep 26, 2013 at 14:44

answered Jan 21, 2010 at 13:46

Dominic Rodger

100k37 gold badges204 silver badges219 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

e-motiv Over a year ago

Confirmed with html5 specs here: stackoverflow.com/questions/5320177/…

danielson317 Over a year ago

+1 for mentioning "ENT_QUOTES". I was already using the this function but double quotes would mess up the html.

Leigh Bicknell Over a year ago

Note that ENT_QUOTES will still cause errors in javascript within html: <a onclick="$.fancybox.open('<php echo htmlspecialchars($variable_with_single_quote, ENT_QUOTES); ?>')">link</a> Use addslashes first and then htmlspecialchars to fix this issue.

frodeborli Over a year ago

@LeighBicknell I think it is better to do htmlspecialchars(json_encode($variable), ENT_QUOTES). I haven't tested it in your particular example, but I think it should work nicely for any type of value.

Tobias K. Over a year ago

Since PHP8.1 ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401 is the default value.

Peter Mortensen · Accepted Answer · 2025-09-05 09:06:12Z

3

Well, before you output any text into HTML you should escape it using htmlspecialchars(). So just make sure (double) quote is correctly changed.

Pay attention to the second parameter of that function:

 int $flags = ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401,

edited Sep 5 at 9:06

Peter Mortensen

31.4k22 gold badges110 silver badges134 bronze badges

answered Jan 21, 2010 at 13:48

Crozin

44.5k13 gold badges92 silver badges136 bronze badges

Comments

Peter Mortensen · Accepted Answer · 2025-09-05 09:07:34Z

-2

The Bat tool has a StringTool::htmlAttributes($arrayOfAttributes) method that does the job too.

edited Sep 5 at 9:07

Peter Mortensen

31.4k22 gold badges110 silver badges134 bronze badges

answered Oct 28, 2015 at 5:26

ling

10.1k4 gold badges58 silver badges54 bronze badges

Collectives™ on Stack Overflow

How can I safely output HTML from a PHP program?

3 Answers 3

5 Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

5 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related