Output escaping with htmlspecialchars in PHP - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of htmlspecialchars with ENT_QUOTES?

Consider the following PHP code snippet. What will it output?

PHP

<?php
$input = "Tom & Jerry's <show>";
echo htmlspecialchars($input, ENT_QUOTES);
?>

A Tom & Jerry's <show>

B Tom & Jerry's <show>

C Tom & Jerry's <show>

D Tom &amp; Jerry&#039;s &lt;show&gt;

💡 Hint

Remember ENT_QUOTES converts both double and single quotes.

htmlspecialchars with ENT_QUOTES converts &, <, >, and both single and double quotes to HTML entities. Single quote becomes '.

❓ Predict Output

intermediate

Output of htmlspecialchars without flags parameter

What will this PHP code output?

PHP

<?php
$text = '5 > 3 & 2 < 4';
echo htmlspecialchars($text);
?>

A 5 &gt; 3 &amp; 2 &lt; 4

B 5 > 3 & 2 < 4

C 5 &gt; 3 & 2 &lt; 4

D 5 &gt; 3 &amp; 2 < 4

💡 Hint

Default flags convert &, <, and > but not quotes.

By default, htmlspecialchars converts &, <, and > to entities but leaves quotes unchanged.

❓ Predict Output

advanced

What error occurs with invalid encoding in htmlspecialchars?

What happens when you run this PHP code?

PHP

<?php
$input = "\xB1\x31";
echo htmlspecialchars($input, ENT_QUOTES, 'UTF-8');
?>

A Warning: htmlspecialchars(): Invalid byte sequence in UTF-8

B Outputs: \xB1\x31

C Outputs: &#177;1

D Fatal error: htmlspecialchars() expects parameter 3 to be string

💡 Hint

Invalid byte sequences cause warnings in htmlspecialchars with UTF-8.

If input contains invalid UTF-8 bytes, htmlspecialchars emits a warning about invalid byte sequence.

🧠 Conceptual

advanced

Why use htmlspecialchars instead of htmlentities?

Which reason best explains why htmlspecialchars is preferred over htmlentities for output escaping?

A htmlentities converts fewer characters, so it is less secure

B htmlspecialchars only converts essential characters, making output more readable and faster

C htmlspecialchars converts all characters to entities, preventing all XSS attacks

D htmlentities does not convert quotes by default

💡 Hint

Think about performance and readability.

htmlspecialchars converts only &, <, >, and quotes, which is enough to prevent most XSS and keeps output readable and faster than htmlentities which converts many more characters.

❓ Predict Output

expert

How many characters are in the output of htmlspecialchars with ENT_NOQUOTES?

Given this PHP code, how many characters will the output string have?

PHP

<?php
$input = "<a href='test'>Click & Learn</a>";
$output = htmlspecialchars($input, ENT_NOQUOTES);
echo strlen($output);
?>

A 31

B 35

C 33

D 29

💡 Hint

Count how many characters are replaced and how many new characters each replacement adds.

ENT_NOQUOTES converts &, <, > but leaves quotes unchanged. The input has 27 characters. '&' becomes '&' (5 chars), '<' becomes '<' (4 chars), '>' becomes '>' (4 chars). Counting replacements results in 33 characters total.

Practice

1. What is the main purpose of the htmlspecialchars function in PHP?

easy

A. To convert special HTML characters to safe codes to prevent code execution

B. To format numbers for display

C. To connect to a database securely

D. To compress HTML output for faster loading

Solution

1. Step 1: Understand the function's role

   htmlspecialchars changes special characters like <, >, &, " into safe HTML entities.

2. Step 2: Recognize the security benefit

   This prevents browsers from interpreting user input as code, protecting against attacks like XSS.

3. Final Answer:

   To convert special HTML characters to safe codes to prevent code execution -> Option A

4. Quick Check:

   htmlspecialchars protects output = To convert special HTML characters to safe codes to prevent code execution [OK]

Hint: Think: 'Make HTML special chars safe' [OK]

Common Mistakes:

• Confusing with formatting functions
• Thinking it compresses or encrypts output
• Assuming it connects to databases

2. Which of the following is the correct syntax to escape a string $input using htmlspecialchars in PHP?

easy

A. html_escape($input);

B. escape_html($input);

C. htmlspecialchars($input);

D. htmlspecialchars_escape($input);

Solution

1. Step 1: Identify the correct function name

   The PHP function to escape HTML special characters is exactly htmlspecialchars.

2. Step 2: Confirm the syntax

   The function is called with the string variable inside parentheses: htmlspecialchars($input);.

3. Final Answer:

   htmlspecialchars($input); -> Option C

4. Quick Check:

   Correct function name and syntax = htmlspecialchars($input); [OK]

Hint: Use exact function name: htmlspecialchars() [OK]

Common Mistakes:

• Using incorrect function names
• Missing parentheses
• Confusing with other escaping functions

3. What will be the output of the following PHP code?

$input = 'Hello & Welcome';
echo htmlspecialchars($input);

medium

A. Hello & Welcome

B. Hello & Welcome

C. <b>Hello & Welcome</b>

D. <b>Hello & Welcome</b>

Solution

1. Step 1: Understand what htmlspecialchars does to special characters

   The characters <, >, and & are converted to &lt;, &gt;, and &amp; respectively.

2. Step 2: Apply htmlspecialchars to the input string

   The string 'Hello & Welcome' becomes '<b>Hello & Welcome</b>'.

3. Final Answer:

   <b>Hello & Welcome</b> -> Option D

4. Quick Check:

   Special chars escaped = <b>Hello & Welcome</b> [OK]

Hint: Remember: <, >, & become <, >, & [OK]

Common Mistakes:

• Expecting HTML tags to remain unescaped
• Not escaping ampersand (&)
• Confusing output with raw HTML

4. Identify the error in this PHP code snippet:

$text = '';
echo htmlspecialchars $text;

medium

A. Incorrect variable name

B. Missing parentheses when calling htmlspecialchars

C. htmlspecialchars does not escape quotes

D. Missing semicolon after variable assignment

Solution

1. Step 1: Check function call syntax

   Functions in PHP require parentheses around arguments. Here, htmlspecialchars $text; is missing parentheses.

2. Step 2: Confirm other syntax elements

   Variable name and semicolons are correct; quotes are escaped by default.

3. Final Answer:

   Missing parentheses when calling htmlspecialchars -> Option B

4. Quick Check:

   Function calls need parentheses = Missing parentheses when calling htmlspecialchars [OK]

Hint: Always use parentheses when calling functions [OK]

Common Mistakes:

• Calling functions without parentheses
• Assuming quotes are not escaped
• Overlooking semicolon placement

5. You want to safely display user input that may contain HTML tags and quotes. Which htmlspecialchars call correctly escapes all special characters including double and single quotes?

hard

A. htmlspecialchars($input, ENT_QUOTES | ENT_HTML5)

B. htmlspecialchars($input, ENT_NOQUOTES)

C. htmlspecialchars($input, ENT_COMPAT)

D. htmlspecialchars($input)

Solution

1. Step 1: Understand the flags for htmlspecialchars

   ENT_QUOTES escapes both single and double quotes; ENT_HTML5 ensures HTML5 entities.

2. Step 2: Compare options

   htmlspecialchars($input, ENT_QUOTES | ENT_HTML5) uses ENT_QUOTES and ENT_HTML5, escaping all quotes and special chars safely.

3. Final Answer:

   htmlspecialchars($input, ENT_QUOTES | ENT_HTML5) -> Option A

4. Quick Check:

   Use ENT_QUOTES to escape all quotes = htmlspecialchars($input, ENT_QUOTES | ENT_HTML5) [OK]

Hint: Use ENT_QUOTES flag to escape all quotes [OK]

Common Mistakes:

• Using ENT_NOQUOTES which skips quote escaping
• Assuming default escapes single quotes
• Not specifying ENT_HTML5 for modern HTML