What is the difference between htmlspecialchars() and htmlentities() in PHP?

The main difference between htmlspecialchars() and htmlentities() in PHP is how they handle characters. htmlspecialchars() only converts the predefined characters (<, >, ", ', &) into their respective HTML entities, while htmlentities() converts all applicable characters to HTML entities. If you want to convert all characters to HTML entities for security purposes, htmlentities() is the better choice. However, if you only want to convert a few characters to prevent XSS attacks, htmlspecialchars() is sufficient.

// Using htmlspecialchars() to convert specific characters to HTML entities
$unsafe_input = "<script>alert('XSS attack');</script>";
$safe_output = htmlspecialchars($unsafe_input, ENT_QUOTES, 'UTF-8');
echo $safe_output;