Output escaping with htmlspecialchars in PHP - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of the htmlspecialchars function in PHP?

It converts special characters to HTML entities to prevent code injection and display text safely in HTML.

beginner

Which characters does htmlspecialchars convert by default?

It converts & (ampersand), < (less than), > (greater than), and " (double quote).

intermediate

What is the difference between htmlspecialchars and htmlentities?

htmlspecialchars converts only special HTML characters, while htmlentities converts all applicable characters to HTML entities.

beginner

How do you use htmlspecialchars to safely display user input in HTML?

Wrap the user input with htmlspecialchars($input, ENT_QUOTES, 'UTF-8') before outputting it.

intermediate

Why is it important to specify the character encoding like 'UTF-8' in htmlspecialchars?

Specifying encoding ensures correct conversion of characters and prevents security issues related to character misinterpretation.

What does htmlspecialchars('<script>alert(1)</script>') output?

A &amp;lt;script&gt;alert(1)&amp;lt;/script&gt;

B &lt;script&gt;alert(1)&lt;/script&gt;

C &amp;lt;script&amp;gt;alert(1)&amp;lt;/script&amp;gt;

D alert(1)

It converts < and > to &lt; and &gt; so the tags show as text, not HTML.

Which flag makes htmlspecialchars convert single quotes as well?

A ENT_QUOTES

B ENT_NOQUOTES

C ENT_COMPAT

D ENT_IGNORE

ENT_QUOTES converts both double and single quotes to HTML entities.

Why should you escape output with htmlspecialchars when displaying user input?

A To make the text bold

B To prevent HTML injection and XSS attacks

C To compress the text

D To change the font color

Escaping prevents users from injecting harmful HTML or scripts.

What happens if you don't specify the encoding in htmlspecialchars?

A It may cause incorrect character conversion and security risks

B It throws an error

C It defaults to UTF-8 safely

D It converts all characters to uppercase

Without specifying encoding, some characters may be misinterpreted, causing security issues.

Which of these is NOT converted by default by htmlspecialchars?

A &amp;

B &lt;

C &gt;

D '

The apostrophe (') is not converted by default unless ENT_QUOTES is used.

Explain why and how you use htmlspecialchars when showing user input on a webpage.

Think about keeping the webpage safe from harmful code.

Describe the difference between htmlspecialchars and htmlentities.

One converts fewer characters, the other more.