get_html_translation_table
Returns the character-to-entity table used internally by htmlspecialchars and htmlentities.
get_html_translation_table(int $table = HTML_SPECIALCHARS, int $flags = ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401, string $encoding = "UTF-8"): array- Added in PHP 4.0
Parameters
| Parameter | Type | Description |
|---|---|---|
$tableoptional | int= HTML_SPECIALCHARS | Which table to return: HTML_SPECIALCHARS for the five special characters, or HTML_ENTITIES for the full entity set. |
$flagsoptional | int= ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401 | Bitmask controlling quote handling (ENT_QUOTES, ENT_COMPAT, ENT_NOQUOTES), invalid-sequence handling (ENT_SUBSTITUTE, ENT_IGNORE) and document type (ENT_HTML401, ENT_HTML5, ENT_XML1, ENT_XHTML). |
$encodingoptional | string= "UTF-8" | The character encoding used when interpreting the table, such as UTF-8 or ISO-8859-1. |
Return value
arrayAn array whose keys are the characters and whose values are the corresponding HTML entities.
Changelog
- PHP 8.1.0The default value of flags changed from ENT_COMPAT to ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401, so the table returned with no arguments now includes the single quote.
get_html_translation_table() hands you the lookup table that htmlspecialchars() and htmlentities() use internally, as a plain PHP array mapping each character to its entity. Passing HTML_SPECIALCHARS gives the short list (&, <, > and, depending on flags, the quotes); passing HTML_ENTITIES gives the full named-entity set, which runs to well over a thousand entries under ENT_HTML5.
When to reach for it
It is mostly an introspection and tooling function. Reach for it when you need to know precisely which characters a given flag combination will encode, to build a reverse map with array_flip() for decoding, to feed strtr() a custom table with entries added or removed, or to write a test that asserts your escaping layer covers everything it should.
What trips people up
For actual output escaping you should call htmlspecialchars(), not rebuild it with this table and strtr() — the real function also validates the input encoding and handles invalid byte sequences, which a naive strtr() does not. Note too that the flags argument controls both quote handling and document type at once; omit a doctype flag and you get HTML 4.01 rules, where the single quote becomes ' rather than HTML5's '.
Example
When to use it
- Building a decode map with array_flip() to turn entities back into characters with strtr().
- Writing a test that asserts your escaping helper covers every character htmlspecialchars would encode.
- Inspecting exactly how a flag combination such as ENT_QUOTES | ENT_HTML5 differs from the HTML 4.01 defaults.
Frequently asked questions
What is the difference between HTML_SPECIALCHARS and HTML_ENTITIES?
HTML_SPECIALCHARS returns only the characters htmlspecialchars() handles — ampersand, less-than, greater-than and the quotes. HTML_ENTITIES returns the full named-entity set used by htmlentities(), over a thousand entries under ENT_HTML5.
Should I use get_html_translation_table with strtr instead of htmlspecialchars?
No. htmlspecialchars() also validates the input encoding and handles invalid byte sequences according to ENT_SUBSTITUTE or ENT_IGNORE; a strtr() built from the table does neither. Use the table for inspection, testing and building decode maps.
Why does my table look different after upgrading to PHP 8.1?
The default flags changed from ENT_COMPAT to ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401, so calling it with no arguments now includes an entry for the single quote. Pass the flags explicitly if you need the old contents.
More examples
Using the table with strtr to encode
Both lines produce the same escaped markup, showing that the table really is what htmlspecialchars() applies. No doctype flag was passed, so HTML 4.01 rules apply and the apostrophe becomes ' rather than '. In real code use htmlspecialchars() directly — it also validates the input encoding, which strtr() does not.
<?php
$table = get_html_translation_table(HTML_SPECIALCHARS, ENT_QUOTES);
$html = '<a href="x">Tom & Jerry\'s</a>';
echo strtr($html, $table), "\n";
echo htmlspecialchars($html, ENT_QUOTES), "\n";Flipping the table to decode
array_flip() turns the character-to-entity map into an entity-to-character map, which strtr() applies to reverse the escaping. For this limited set the result matches html_entity_decode(), but the flipped table only knows the five special characters — decoding arbitrary HTML still needs html_entity_decode() with HTML_ENTITIES semantics.
<?php
$decode = array_flip(get_html_translation_table(HTML_SPECIALCHARS, ENT_QUOTES));
$in = '5 < 7 && 7 > 5';
echo strtr($in, $decode), "\n";
var_dump(strtr($in, $decode) === html_entity_decode($in, ENT_QUOTES));Seeing what the flags actually change
The first diff shows the single quote is the only key ENT_QUOTES adds over ENT_COMPAT. The second shows the same key present in both but with a different value: HTML 4.01 has no named apostrophe entity so it emits ', while HTML5 emits '. This is the fastest way to confirm what a flag combination will do before you rely on it.
<?php
$compat = get_html_translation_table(HTML_SPECIALCHARS, ENT_COMPAT);
$quotes = get_html_translation_table(HTML_SPECIALCHARS, ENT_QUOTES);
$html5 = get_html_translation_table(HTML_SPECIALCHARS, ENT_QUOTES | ENT_HTML5);
print_r(array_diff_key($quotes, $compat));
print_r(array_diff_assoc($html5, $quotes));
Discussion