ENT_SUBSTITUTE and ENT_DISALLOWED solve different input problems. The first replaces invalid code-unit sequences for the selected encoding. The second replaces valid characters that the selected HTML or XML document type does not allow.
Last updated: October 27, 2026.
<?php
function escapeHtml(string $value): string
{
return htmlspecialchars(
$value,
ENT_QUOTES | ENT_SUBSTITUTE | ENT_DISALLOWED | ENT_HTML5,
'UTF-8',
true
);
}
echo escapeHtml("Name: <Admin>");
// Invalid UTF-8 byte becomes U+FFFD; markup is escaped.Specify the encoding and document type explicitly. For an HTML5 page using UTF-8, this combination escapes markup, preserves ordinary Unicode text, replaces malformed UTF-8, and replaces characters disallowed by HTML5.
Match each flag to the input failure
The htmlspecialchars() documentation defines ENT_SUBSTITUTE as replacement for invalid code-unit sequences. In UTF-8, an isolated continuation byte such as is malformed, so it becomes the Unicode replacement character instead of causing an empty result. The same flags are documented for htmlentities().
ENT_DISALLOWED addresses a different case: the bytes form a valid character, but that code point is not permitted by ENT_HTML5, ENT_XML1, or another selected document type. It is useful when external content must produce a well-formed document. It does not repair an unknown source encoding; convert known legacy encodings before escaping.
Escape for the exact output context
For normal HTML text and quoted attribute values, htmlspecialchars() with ENT_QUOTES is usually the correct encoder. htmlentities() additionally converts characters that have named entities, which is rarely necessary for a UTF-8 page. Neither function is the correct encoder for JavaScript, CSS, URLs, or SQL.
Avoid ENT_IGNORE for untrusted input because silently deleting bytes can change meaning. Validate text at the application boundary, store valid UTF-8, and escape only when producing output. Continue with fixing invalid UTF-8 in JSON, understanding HTML entities, and processing PHP forms securely.
