note 86240 added to function.htmlspecialchars

if your goal is just to protect your page from Cross Site Scripting (XSS) attack, or just to show HTML tags on a web page (showing <body> on the page, for example), then using htmlspecialchars() is good enough and better than using htmlentities(). A minor point is htmlspecialchars() is faster than htmlentities(). A more important point is, when we use htmlspecialchars($s) in our code, it is automatically compatible with UTF-8 string. Otherwise, if we use htmlentities($s), and there happens to be foreign characters in the string $s in UTF-8 encoding, then htmlentities() is going to mess it up, as it modifies the byte 0x80 to 0xFF in the string to entities like &eacute;. (unless you specifically provide a second argument and a third argument to htmlentities(), with the third argument being "UTF-8"). The reason htmlspecialchars($s) already works with UTF-8 string is that, it changes bytes that are in the range 0x00 to 0x7F to &lt; etc, while leaving bytes in the range 0x80 to 0xFF unchanged. We may wonder whether htmlspecialchars() may accidentally change any byte in a 2 to 4 byte UTF-8 character to &lt; etc. The answer is, it won't. When a UTF-8 character is 2 to 4 bytes long, all the bytes in this character is in the 0x80 to 0xFF range. None can be in the 0x00 to 0x7F range. When a UTF-8 character is 1 byte long, it is just the same as ASCII, which is 7 bit, from 0x00 to 0x7F. As a result, when a UTF-8 character is 1 byte long, htmlspecialchars($s) will do its job, and when the UTF-8 character is 2 to 4 bytes long, htmlspecialchars($s) will just pass those bytes unchanged. So htmlspecialchars($s) will do the same job no matter whether $s is in ASCII, ISO-8859-1 (Latin-1), or UTF-8. ---- Server IP: 69.147.83.197 Probable Submitter: 99.182.233.86 ---- Manual Page -- http://www.php.net/manual/en/function.htmlspecialchars.php Edit -- https://master.php.net/note/edit/86240 Del: integrated -- https://master.php.net/note/delete/86240/integrated Del: useless -- https://master.php.net/note/delete/86240/useless Del: bad code -- https://master.php.net/note/delete/86240/bad+code Del: spam -- https://master.php.net/note/delete/86240/spam Del: non-english -- https://master.php.net/note/delete/86240/non-english Del: in docs -- https://master.php.net/note/delete/86240/in+docs Del: other reasons-- https://master.php.net/note/delete/86240 Reject -- https://master.php.net/note/reject/86240 Search -- https://master.php.net/manage/user-notes.php