Output escaping with htmlspecialchars in PHP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to escape special HTML characters in the string.

PHP

<?php
$text = "<script>alert('Hi');</script>";
echo [1]($text);
?>

Drag options to blanks, or click blank then click option'

Ahtmlspecialchars

Bhtmlentities

Cstrip_tags

Daddslashes

Attempts:

3 left

💡 Hint

Common Mistakes

Using strip_tags removes tags but does not escape characters.

Using addslashes escapes quotes but not HTML special characters.

The htmlspecialchars function converts special characters to HTML entities, preventing code injection in HTML output.

2fill in blank

medium

Complete the code to escape special characters and convert quotes to HTML entities.

PHP

<?php
$text = 'He said "Hello" & left.';
echo htmlspecialchars($text, [1]);
?>

Drag options to blanks, or click blank then click option'

AENT_NOQUOTES

BENT_IGNORE

CENT_QUOTES

DENT_COMPAT

Attempts:

3 left

💡 Hint

Common Mistakes

Using ENT_NOQUOTES leaves quotes unescaped.

Using ENT_COMPAT escapes only double quotes.

The ENT_QUOTES flag converts both double and single quotes to HTML entities.

3fill in blank

hard

Fix the error in the code to properly escape the output with UTF-8 encoding.

PHP

<?php
$text = '<b>Bold</b> & "Quotes"';
echo htmlspecialchars($text, ENT_QUOTES, [1]);
?>

Drag options to blanks, or click blank then click option'

A"UTF-8"

B"ISO-8859-1"

C"ASCII"

D"UTF-16"

Attempts:

3 left

💡 Hint

Common Mistakes

Using ISO-8859-1 may cause issues with non-Latin characters.

ASCII does not support special characters beyond basic English.

Using "UTF-8" ensures correct encoding of multibyte characters when escaping HTML.

4fill in blank

hard

Fill both blanks to escape the string and prevent double encoding.

PHP

<?php
$text = '<a href="test">Link</a>';
echo htmlspecialchars($text, [1], 'UTF-8', [2]);
?>

Drag options to blanks, or click blank then click option'

AENT_QUOTES

BENT_NOQUOTES

Ctrue

Dfalse

Attempts:

3 left

💡 Hint

Common Mistakes

Setting double_encode to true causes already escaped entities to be escaped again.

Using ENT_NOQUOTES leaves quotes unescaped.

Use ENT_QUOTES to escape quotes and false to prevent double encoding.

5fill in blank

hard

Fill all three blanks to create a safe HTML output with escaped text and a newline converted to <br>.

PHP

<?php
$text = "Hello & welcome\nHave a nice day!";
$safe_text = nl2br(htmlspecialchars([1], [2], [3]));
echo $safe_text;
?>

Drag options to blanks, or click blank then click option'

A$text

BENT_QUOTES

C"UTF-8"

DENT_NOQUOTES

Attempts:

3 left

💡 Hint

Common Mistakes

Using ENT_NOQUOTES leaves quotes unescaped.

Not passing the variable to htmlspecialchars causes errors.

Escape the variable $text with ENT_QUOTES and "UTF-8" encoding, then convert newlines to <br> tags.