What are the differences between htmlspecialchars() and htmlentities() in PHP?

The main difference between htmlspecialchars() and htmlentities() in PHP is that htmlspecialchars() only converts predefined characters (like < and >) to their HTML entities, while htmlentities() converts all applicable characters to HTML entities. If you want to encode user input to prevent XSS attacks, it is generally recommended to use htmlspecialchars().

// Using htmlspecialchars() to encode user input
$user_input = "<script>alert('XSS attack')</script>";
$encoded_input = htmlspecialchars($user_input, ENT_QUOTES, 'UTF-8');
echo $encoded_input;