wppaste
WordPress

_wp_specialchars( string $text, int|string $quote_style = ENT_NOQUOTES, false|string $charset = false, bool $double_encode = false ): string

Since
1.2.2, 5.5.0
Source
wp-includes/formatting.php:945
Converts a number of special characters into their HTML entities.

Description

Specifically deals with: &, <, >, ", and '.

$quote_style can be set to ENT_COMPAT to encode " to &quot;, or ENT_QUOTES to do both. Default is ENT_NOQUOTES where no quotes are encoded.

Compatibility

WordPress
since 5.5.0
PHP
7.4–8.6-dev
  • 6.7.7
  • 6.8.8
  • 6.9.7
  • 7.0.4
  • 7.1.0

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Parameters

$textstring
The text which is to be encoded.
$quote_styleint|stringoptional
Converts double quotes if set to ENT_COMPAT, both single and double if set to ENT_QUOTES or none if set to ENT_NOQUOTES.
Converts single and double quotes, as well as converting HTML named entities (that are not also XML named entities) to their code points if set to ENT_XML1. Also compatible with old values; converting single quotes if set to 'single', double if set to 'double' or both if otherwise set.
Default is ENT_NOQUOTES.Default: ENT_NOQUOTES
$charsetfalse|stringoptional
The character encoding of the string. Default false.Default: false
$double_encodebooloptional
Whether to encode existing HTML entities. Default false.Default: false

Return value

string
The encoded text with HTML entities.

Performance profile

How much work a call to _wp_specialchars() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class
Moderate

Reads stored settings via get_option(), cached per request but not free on a cold cache.

Scaling
Constant

No loop in the body: the same number of instructions runs whatever you pass in.

Instructions
10–56

Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 68.

Plugin surface
None

Nothing here hands control to plugin code.

Called by
5

5 places in core call this, so the cost is paid more often than your own code shows.

What it touches

  • optionoption read or writeget_option()called directly
  • hookthird-party callbacksapply_filters()one call below _wp_specialchars()
  • cacheobject cachewp_cache_get()one call below _wp_specialchars()
  • serializeserialisationmaybe_unserialize()one call below _wp_specialchars()

Further down the call graph this can also reach query and transient. Those are the worst case, several calls deep and usually down an error path, not what a normal call pays.

What one call costs · 5 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost _wp_specialchars() can have, taken from its control-flow graph on PHP 8.5.

WhenInstructionsCalls it makes
always10–12none
$text38–45_canonical_charset(), htmlspecialchars()
$text40–47get_option(), _canonical_charset(), htmlspecialchars()
$text46–54_canonical_charset(), wp_kses_normalize_entities(), htmlspecialchars()
$text48–56get_option(), _canonical_charset(), wp_kses_normalize_entities(), htmlspecialchars()

Across PHP versions

PHPCompiledExecutedBranchesNotes
8.6-dev6710–55111 fewer instruction than PHP 8.5
8.56810–5611
8.46810–56116 fewer instructions than PHP 8.3
8.37410–6211
8.27410–6211
8.17410–6211
7.47410–6211

An instruction is not a fixed amount of time, so a matching count is not necessarily the same speed; what it rules out is a difference in the work itself.

Uses · 3

Used by · 5

Source code

View on Trac View on GitHub 

function _wp_specialchars( $text, $quote_style = ENT_NOQUOTES, $charset = false, $double_encode = false ) {	$text = (string) $text; 	if ( 0 === strlen( $text ) ) {		return '';	} 	// Don't bother if there are no specialchars - saves some processing.	if ( ! preg_match( '/[&<>"\']/', $text ) ) {		return $text;	} 	// Account for the previous behavior of the function when the $quote_style is not an accepted value.	if ( empty( $quote_style ) ) {		$quote_style = ENT_NOQUOTES;	} elseif ( ENT_XML1 === $quote_style ) {		$quote_style = ENT_QUOTES | ENT_XML1;	} elseif ( ! in_array( $quote_style, array( ENT_NOQUOTES, ENT_COMPAT, ENT_QUOTES, 'single', 'double' ), true ) ) {		$quote_style = ENT_QUOTES;	} 	$charset = _canonical_charset( $charset ? $charset : get_option( 'blog_charset' ) ); 	$_quote_style = $quote_style; 	if ( 'double' === $quote_style ) {		$quote_style  = ENT_COMPAT;		$_quote_style = ENT_COMPAT;	} elseif ( 'single' === $quote_style ) {		$quote_style = ENT_NOQUOTES;	} 	if ( ! $double_encode ) {		/*		 * Guarantee every &entity; is valid, convert &garbage; into &amp;garbage;		 * This is required for PHP < 5.4.0 because ENT_HTML401 flag is unavailable.		 */		$text = wp_kses_normalize_entities( $text, ( $quote_style & ENT_XML1 ) ? 'xml' : 'html' );	} 	$text = htmlspecialchars( $text, $quote_style, $charset, $double_encode ); 	// Back-compat.	if ( 'single' === $_quote_style ) {		$text = str_replace( "'", '&#039;', $text );	} 	return $text;}

Changelog

Introduced in 1.2.2. Unchanged from 6.7.7 through 7.1.0.

  1. 6.7.7
  2. 6.8.8
  3. 6.9.7
  4. 7.0.4
  5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

5.5.0
$quote_style also accepts ENT_XML1.from the docblock
1.2.2
Introduced.from the docblock

About this page

Parsed data
Generated from the wordpress-develop 7.1.0 tag, from src/wp-includes/formatting.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.
Corrections
Something wrong on this page? Report it and it gets fixed in the next regeneration.