Output escaping with htmlspecialchars in PHP - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of the htmlspecialchars function in PHP?

It converts special characters to HTML entities to prevent code injection and display text safely in HTML.

beginner

Which characters does htmlspecialchars convert by default?

It converts & (ampersand), < (less than), > (greater than), and " (double quote).

intermediate

What is the difference between htmlspecialchars and htmlentities?

htmlspecialchars converts only special HTML characters, while htmlentities converts all applicable characters to HTML entities.

beginner

How do you use htmlspecialchars to safely display user input in HTML?

Wrap the user input with htmlspecialchars($input, ENT_QUOTES, 'UTF-8') before outputting it.

intermediate

Why is it important to specify the character encoding like 'UTF-8' in htmlspecialchars?

Specifying encoding ensures correct conversion of characters and prevents security issues related to character misinterpretation.

What does htmlspecialchars('<script>alert(1)</script>') output?

A &amp;lt;script&gt;alert(1)&amp;lt;/script&gt;

B &lt;script&gt;alert(1)&lt;/script&gt;

C &amp;lt;script&amp;gt;alert(1)&amp;lt;/script&amp;gt;

D alert(1)

It converts < and > to &lt; and &gt; so the tags show as text, not HTML.

Which flag makes htmlspecialchars convert single quotes as well?

A ENT_QUOTES

B ENT_NOQUOTES

C ENT_COMPAT

D ENT_IGNORE

ENT_QUOTES converts both double and single quotes to HTML entities.

Why should you escape output with htmlspecialchars when displaying user input?

A To make the text bold

B To prevent HTML injection and XSS attacks

C To compress the text

D To change the font color

Escaping prevents users from injecting harmful HTML or scripts.

What happens if you don't specify the encoding in htmlspecialchars?

A It may cause incorrect character conversion and security risks

B It throws an error

C It defaults to UTF-8 safely

D It converts all characters to uppercase

Without specifying encoding, some characters may be misinterpreted, causing security issues.

Which of these is NOT converted by default by htmlspecialchars?

A &amp;

B &lt;

C &gt;

D '

The apostrophe (') is not converted by default unless ENT_QUOTES is used.

Explain why and how you use htmlspecialchars when showing user input on a webpage.

Think about keeping the webpage safe from harmful code.

Describe the difference between htmlspecialchars and htmlentities.

One converts fewer characters, the other more.

Practice

1. What is the main purpose of the htmlspecialchars function in PHP?

easy

A. To convert special HTML characters to safe codes to prevent code execution

B. To format numbers for display

C. To connect to a database securely

D. To compress HTML output for faster loading

Solution

1. Step 1: Understand the function's role

   htmlspecialchars changes special characters like <, >, &, " into safe HTML entities.

2. Step 2: Recognize the security benefit

   This prevents browsers from interpreting user input as code, protecting against attacks like XSS.

3. Final Answer:

   To convert special HTML characters to safe codes to prevent code execution -> Option A

4. Quick Check:

   htmlspecialchars protects output = To convert special HTML characters to safe codes to prevent code execution [OK]

Hint: Think: 'Make HTML special chars safe' [OK]

Common Mistakes:

• Confusing with formatting functions
• Thinking it compresses or encrypts output
• Assuming it connects to databases

2. Which of the following is the correct syntax to escape a string $input using htmlspecialchars in PHP?

easy

A. html_escape($input);

B. escape_html($input);

C. htmlspecialchars($input);

D. htmlspecialchars_escape($input);

Solution

1. Step 1: Identify the correct function name

   The PHP function to escape HTML special characters is exactly htmlspecialchars.

2. Step 2: Confirm the syntax

   The function is called with the string variable inside parentheses: htmlspecialchars($input);.

3. Final Answer:

   htmlspecialchars($input); -> Option C

4. Quick Check:

   Correct function name and syntax = htmlspecialchars($input); [OK]

Hint: Use exact function name: htmlspecialchars() [OK]

Common Mistakes:

• Using incorrect function names
• Missing parentheses
• Confusing with other escaping functions

3. What will be the output of the following PHP code?

$input = 'Hello & Welcome';
echo htmlspecialchars($input);

medium

A. Hello & Welcome

B. Hello & Welcome

C. <b>Hello & Welcome</b>

D. <b>Hello & Welcome</b>

Solution

1. Step 1: Understand what htmlspecialchars does to special characters

   The characters <, >, and & are converted to &lt;, &gt;, and &amp; respectively.

2. Step 2: Apply htmlspecialchars to the input string

   The string 'Hello & Welcome' becomes '<b>Hello & Welcome</b>'.

3. Final Answer:

   <b>Hello & Welcome</b> -> Option D

4. Quick Check:

   Special chars escaped = <b>Hello & Welcome</b> [OK]

Hint: Remember: <, >, & become <, >, & [OK]

Common Mistakes:

• Expecting HTML tags to remain unescaped
• Not escaping ampersand (&)
• Confusing output with raw HTML

4. Identify the error in this PHP code snippet:

$text = '';
echo htmlspecialchars $text;

medium

A. Incorrect variable name

B. Missing parentheses when calling htmlspecialchars

C. htmlspecialchars does not escape quotes

D. Missing semicolon after variable assignment

Solution

1. Step 1: Check function call syntax

   Functions in PHP require parentheses around arguments. Here, htmlspecialchars $text; is missing parentheses.

2. Step 2: Confirm other syntax elements

   Variable name and semicolons are correct; quotes are escaped by default.

3. Final Answer:

   Missing parentheses when calling htmlspecialchars -> Option B

4. Quick Check:

   Function calls need parentheses = Missing parentheses when calling htmlspecialchars [OK]

Hint: Always use parentheses when calling functions [OK]

Common Mistakes:

• Calling functions without parentheses
• Assuming quotes are not escaped
• Overlooking semicolon placement

5. You want to safely display user input that may contain HTML tags and quotes. Which htmlspecialchars call correctly escapes all special characters including double and single quotes?

hard

A. htmlspecialchars($input, ENT_QUOTES | ENT_HTML5)

B. htmlspecialchars($input, ENT_NOQUOTES)

C. htmlspecialchars($input, ENT_COMPAT)

D. htmlspecialchars($input)

Solution

1. Step 1: Understand the flags for htmlspecialchars

   ENT_QUOTES escapes both single and double quotes; ENT_HTML5 ensures HTML5 entities.

2. Step 2: Compare options

   htmlspecialchars($input, ENT_QUOTES | ENT_HTML5) uses ENT_QUOTES and ENT_HTML5, escaping all quotes and special chars safely.

3. Final Answer:

   htmlspecialchars($input, ENT_QUOTES | ENT_HTML5) -> Option A

4. Quick Check:

   Use ENT_QUOTES to escape all quotes = htmlspecialchars($input, ENT_QUOTES | ENT_HTML5) [OK]

Hint: Use ENT_QUOTES flag to escape all quotes [OK]

Common Mistakes:

• Using ENT_NOQUOTES which skips quote escaping
• Assuming default escapes single quotes
• Not specifying ENT_HTML5 for modern HTML