In PHP 8.5, the html_entity_decode() function works the same as in PHP 8.0 and later. It converts HTML entities (like <, &, or ©) back into their corresponding characters (<, &, or ©).
Function Signature
html_entity_decode(
string $string,
int $flags = ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401,
?string $encoding = null
): string
The default $flags value was updated in PHP 8.1 to ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401 . If $encoding is omitted, it uses the default_charset configuration (usually UTF-8).
Example
<?php
$encoded = "I'll "walk" the <b>dog</b> now";// Decode with ENT_QUOTES to handle both single and double quotes
$decoded = html_entity_decode($encoded, ENT_QUOTES, UTF-8 );echo $decoded;
// Output: I ll "walk" the <b>dog</b> now
?>
Important Note on Security
Do not use html_entity_decode() on user input immediately before displaying it in a browser. Decoding entities can reintroduce HTML tags (like <script>), creating an XSS vulnerability. Only decode when you need the raw characters for non-HTML purposes (e.g., logging, PDF generation, or text comparison).