function Html::escape

Escapes text by converting special characters to HTML entities.

This method escapes HTML for sanitization purposes by replacing the following special characters with their HTML entity equivalents:

  • & (ampersand) becomes &
  • " (double quote) becomes "
  • ' (single quote) becomes '
  • < (less than) becomes &lt;
  • > (greater than) becomes &gt;

Special characters that have already been escaped will be double-escaped (for example, "&lt;" becomes "&amp;lt;"), and invalid UTF-8 encoding will be converted to the Unicode replacement character ("�").

This method is not the opposite of Html::decodeEntities(). For example, this method will not encode "é" to "&eacute;", whereas Html::decodeEntities() will convert all HTML entities to UTF-8 bytes, including "&eacute;" and "&lt;" to "é" and "<".

When constructing render arrays passing the output of Html::escape() to '#markup' is not recommended. Use the '#plain_text' key instead and the renderer will autoescape the text.

Parameters

string $text: The input text.

Return value

string The text with all HTML special characters converted.

See also

htmlspecialchars()

\Drupal\Component\Utility\Html::decodeEntities()

51 calls to Html::escape()
AccountForm::form in core/modules/user/src/AccountForm.php
Gets the actual form array to be built.
AttributeArray::__toString in core/lib/Drupal/Core/Template/AttributeArray.php
Implements the magic __toString() method.
AttributeBoolean::__toString in core/lib/Drupal/Core/Template/AttributeBoolean.php
Implements the magic __toString() method.
AttributeString::__toString in core/lib/Drupal/Core/Template/AttributeString.php
Implements the magic __toString() method.
AttributeValueBase::render in core/lib/Drupal/Core/Template/AttributeValueBase.php
Returns a string representation of the attribute.

... See full list

File

core/lib/Drupal/Component/Utility/Html.php, line 431

Class

Html
Provides DOMDocument helpers for parsing and serializing HTML strings.

Namespace

Drupal\Component\Utility

Code

public static function escape(string $text) : string {
    return htmlspecialchars($text, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
}