HTML Escape Helper
Escapes untrusted text for safe HTML body or attribute output.
Function signature
ogEscapeHtmlValue(value)
Categories
- Security
Parameters
valueRaw value to escape.Return value
string
Compatibility
Existing function name and call order preserved; metadata signature corrected to source.
Minimum PHP version: 7.4
Security notes
Validate request method, identity, permissions, and caller-owned allowlists before use; keep secrets out of public output.
Code
<?php
/*
* Copyright (c) 2026 Jeffery L. Paris <jparis@phpog.com>.
* Free for personal and internal use. Paid project use requires visible credit
* to Jeffery L. Paris. Corporate use requires a paid license fee unless a
* separate written license states otherwise.
*/
/**
* Escapes untrusted text for safe HTML body or attribute output.
*
* Primary use case: Prevent XSS in templates and PHP-built fragments.
* Typical inputs: raw value, context option.
* Typical output: escaped string.
*
* Implementation note: Use ENT_QUOTES, ENT_SUBSTITUTE, UTF-8.
*
* @param mixed $value Raw value to escape.
* @return string Escaped UTF-8 HTML-safe value.
*/
function ogEscapeHtmlValue($value) {
return htmlspecialchars((string)$value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
}