Output escaping with htmlspecialchars in PHP - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of htmlspecialchars with ENT_QUOTES?

Consider the following PHP code snippet. What will it output?

PHP

<?php
$input = "Tom & Jerry's <show>";
echo htmlspecialchars($input, ENT_QUOTES);
?>

A Tom & Jerry's <show>

B Tom & Jerry's <show>

C Tom & Jerry's <show>

D Tom &amp; Jerry&#039;s &lt;show&gt;

💡 Hint

Remember ENT_QUOTES converts both double and single quotes.

htmlspecialchars with ENT_QUOTES converts &, <, >, and both single and double quotes to HTML entities. Single quote becomes '.

❓ Predict Output

intermediate

Output of htmlspecialchars without flags parameter

What will this PHP code output?

PHP

<?php
$text = '5 > 3 & 2 < 4';
echo htmlspecialchars($text);
?>

A 5 &gt; 3 &amp; 2 &lt; 4

B 5 > 3 & 2 < 4

C 5 &gt; 3 & 2 &lt; 4

D 5 &gt; 3 &amp; 2 < 4

💡 Hint

Default flags convert &, <, and > but not quotes.

By default, htmlspecialchars converts &, <, and > to entities but leaves quotes unchanged.

❓ Predict Output

advanced

What error occurs with invalid encoding in htmlspecialchars?

What happens when you run this PHP code?

PHP

<?php
$input = "\xB1\x31";
echo htmlspecialchars($input, ENT_QUOTES, 'UTF-8');
?>

A Warning: htmlspecialchars(): Invalid byte sequence in UTF-8

B Outputs: \xB1\x31

C Outputs: &#177;1

D Fatal error: htmlspecialchars() expects parameter 3 to be string

💡 Hint

Invalid byte sequences cause warnings in htmlspecialchars with UTF-8.

If input contains invalid UTF-8 bytes, htmlspecialchars emits a warning about invalid byte sequence.

🧠 Conceptual

advanced

Why use htmlspecialchars instead of htmlentities?

Which reason best explains why htmlspecialchars is preferred over htmlentities for output escaping?

A htmlentities converts fewer characters, so it is less secure

B htmlspecialchars only converts essential characters, making output more readable and faster

C htmlspecialchars converts all characters to entities, preventing all XSS attacks

D htmlentities does not convert quotes by default

💡 Hint

Think about performance and readability.

htmlspecialchars converts only &, <, >, and quotes, which is enough to prevent most XSS and keeps output readable and faster than htmlentities which converts many more characters.

❓ Predict Output

expert

How many characters are in the output of htmlspecialchars with ENT_NOQUOTES?

Given this PHP code, how many characters will the output string have?

PHP

<?php
$input = "<a href='test'>Click & Learn</a>";
$output = htmlspecialchars($input, ENT_NOQUOTES);
echo strlen($output);
?>

A 31

B 35

C 33

D 29

💡 Hint

Count how many characters are replaced and how many new characters each replacement adds.

ENT_NOQUOTES converts &, <, > but leaves quotes unchanged. The input has 27 characters. '&' becomes '&' (5 chars), '<' becomes '<' (4 chars), '>' becomes '>' (4 chars). Counting replacements results in 33 characters total.