htmlspecialchars_decode
(PHP 5 >= 5.1.0)
htmlspecialchars_decode — Convert special HTML entities back to characters
Description
$string
[, int $flags
= ENT_COMPAT | ENT_HTML401
] )This function is the opposite of htmlspecialchars(). It converts special HTML entities back to characters.
The converted entities are: &,
" (when ENT_NOQUOTES
is not set),
' (when ENT_QUOTES
is set),
< and >.
Parameters
-
string
-
The string to decode.
-
flags
-
A bitmask of one or more of the following flags, which specify how to handle quotes and which document type to use. The default is ENT_COMPAT | ENT_HTML401.
Available flags
constantsConstant Name Description ENT_COMPAT
Will convert double-quotes and leave single-quotes alone. ENT_QUOTES
Will convert both double and single quotes. ENT_NOQUOTES
Will leave both double and single quotes unconverted. ENT_HTML401
Handle code as HTML 4.01. ENT_XML1
Handle code as XML 1. ENT_XHTML
Handle code as XHTML. ENT_HTML5
Handle code as HTML 5.
Return Values
Returns the decoded string.
Changelog
Version | Description |
---|---|
5.4.0 |
The constants ENT_HTML401 , ENT_XML1 ,
ENT_XHTML and ENT_HTML5 were added.
|
Examples
Example #1 A htmlspecialchars_decode() example
<?php
$str = "<p>this -> "</p>\n";
echo htmlspecialchars_decode($str);
// note that here the quotes aren't converted
echo htmlspecialchars_decode($str, ENT_NOQUOTES);
?>
The above example will output:
<p>this -> "</p> <p>this -> "</p>
See Also
- htmlspecialchars() - Convert special characters to HTML entities
- html_entity_decode() - Convert all HTML entities to their applicable characters
- get_html_translation_table() - Returns the translation table used by htmlspecialchars and htmlentities
- addcslashes
- addslashes
- bin2hex
- chop
- chr
- chunk_split
- convert_cyr_string
- convert_uudecode
- convert_uuencode
- count_chars
- crc32
- crypt
- echo
- explode
- fprintf
- get_html_translation_table
- hebrev
- hebrevc
- hex2bin
- html_entity_decode
- htmlentities
- htmlspecialchars_decode
- htmlspecialchars
- implode
- join
- lcfirst
- levenshtein
- localeconv
- ltrim
- md5_file
- md5
- metaphone
- money_format
- nl_langinfo
- nl2br
- number_format
- ord
- parse_str
- printf
- quoted_printable_decode
- quoted_printable_encode
- quotemeta
- rtrim
- setlocale
- sha1_file
- sha1
- similar_text
- soundex
- sprintf
- sscanf
- str_getcsv
- str_ireplace
- str_pad
- str_repeat
- str_replace
- str_rot13
- str_shuffle
- str_split
- str_word_count
- strcasecmp
- strchr
- strcmp
- strcoll
- strcspn
- strip_tags
- stripcslashes
- stripos
- stripslashes
- stristr
- strlen
- strnatcasecmp
- strnatcmp
- strncasecmp
- strncmp
- strpbrk
- strpos
- strrchr
- strrev
- strripos
- strrpos
- strspn
- strstr
- strtok
- strtolower
- strtoupper
- strtr
- substr_compare
- substr_count
- substr_replace
- substr
- trim
- ucfirst
- ucwords
- vfprintf
- vprintf
- vsprintf
- wordwrap
Коментарии
For PHP4 Compatibility:
<?php
function htmlspecialchars_decode_php4 ($str) {
return strtr($str, array_flip(get_html_translation_table(HTML_SPECIALCHARS)));
}
?>
[Update of previous note, having noticed I forgot to put in quote style]
PHP4 Compatible function:
<?php
function htmlspecialchars_decode_php4 ($str, $quote_style = ENT_COMPAT) {
return strtr($str, array_flip(get_html_translation_table(HTML_SPECIALCHARS, $quote_style)));
}
?>
that works also with ä and " and so on.
get_html_translation_table(HTML_ENTITIES) => offers more characters than HTML_SPECIALCHARS
function htmlspecialchars_decode_PHP4($uSTR)
{
return strtr($uSTR, array_flip(get_html_translation_table(HTML_ENTITIES, ENT_QUOTES)));
}
This should be the best way to do it.
(Reposted because the other one seems a bit slower and because those who used the code under called it htmlspecialchars_decode_php4)
<?php
if ( !function_exists('htmlspecialchars_decode') )
{
function htmlspecialchars_decode($text)
{
return strtr($text, array_flip(get_html_translation_table(HTML_SPECIALCHARS)));
}
}
?>
The example for "htmlspecialchars_decode()" below sadly does not work for all PHP4 versions.
Quote from the PHP manual:
"get_html_translation_table() will return the translation table that is used internally for htmlspecialchars() and htmlentities()."
But it does NOT! At least not for PHP version 4.4.2.
This was already reported in a bug report (http://bugs.php.net/bug.php?id=25927), but it was marked as BOGUS.
Proof:
Code:
--------------------
<?php
var_dump(get_html_translation_table(HTML_SPECIALCHARS,ENT_QUOTES));
var_dump(htmlspecialchars('\'',ENT_QUOTES));
?>
--------------------
Output:
--------------------
array
'"' => '"'
''' => '''
'<' => '<'
'>' => '>'
'&' => '&'
'''
--------------------
This comment now is not to report this bug again (though I really believe it is one), but to complete the example and warn people of this pitfall.
To make sure your htmlspecialchars_decode fake for PHP4 works, you should do something like this:
<?php
function htmlspecialchars_decode($string,$style=ENT_COMPAT)
{
$translation = array_flip(get_html_translation_table(HTML_SPECIALCHARS,$style));
if($style === ENT_QUOTES){ $translation['''] = '\''; }
return strtr($string,$translation);
}
?>
Br, Thomas
If you use `htmlspecialchars()` to change things like the ampersand (&) into it's HTML equivalent (&), you might run into a situation where you mistakenly pass the same string to the function twice, resulting in things appearing on your website like, as I call it, the ampersanded amp; "&". Clearly nobody want's "&" on his or her web page where there is supposed to be just an ampersand. Here's a quick and easy trick to make sure this doesn't happen:
<?php
$var = "This is a string that could be passed to htmlspecialchars multiple times.";
if (htmlspecialchars_decode($var) == $var) {
$var = htmlspecialchars($var);
}
echo $var;
?>
Now, if your dealing with text that is a mixed bag (has HTML entities and non-HTML entities) you're on your own.
or of course:
<?php
$var = "Blue & yellow make green.";
$var = (htmlspecialchars_decode($var) == $var) ? htmlspecialchars($var) : $var;
echo $var; // outputs Blue & yellow make green.
// you can do it a bunch of times, it still won't screw you!
$var = (htmlspecialchars_decode($var) == $var) ? htmlspecialchars($var) : $var;
$var = (htmlspecialchars_decode($var) == $var) ? htmlspecialchars($var) : $var;
echo $var; // still outputs Blue & yellow make green.
?>
Put it in a function. Add it to the method of some abstract data class.
Keep in mind that you should never trust user input - particularly for "mixed-bag" input containing a combination of plain text and markup or scripting code.
Why?
Well, consider someone sending '&<script>alert('XSS');</script>' to your PHP script:
<?php
$var = "&<script>alert('XSS');</script>";
$var = (htmlspecialchars_decode($var) == $var) ? htmlspecialchars($var) : $var;
echo $var;
?>
Since '&' decodes into '&', (htmlspecialchars_decode($var) == $var) will be -false-, thus returning $var without that it's escaped. In consequence, the script-tags are untouched, and you've just opened yourself to XSS.
There is, unfortunately, no reliable way to determine whether HTML is escaped or not that does not come with this caveat that I know of. Rather than try and catch the case 'I've already encoded this', you are better off avoiding double-escaping by simply escaping the HTML as close to the actual output as you can muster, e.g. in the view in an MVC development structure.