HTML entity encode/decode · Guide

html_entity_decode Not Working: The Usual Causes

When decoding appears to do nothing, the function is almost always working correctly and the input is not what you think. Five causes cover nearly every report.

Missing flags

Single quotes are the most common survivor. Without ENT_QUOTES, ' and ' are left untouched on older PHP defaults:

PHP
html_entity_decode($s);                                    // may skip quotes
html_entity_decode($s, ENT_QUOTES | ENT_HTML5, 'UTF-8');   // decodes everything

' specifically needs ENT_HTML5 — it is not part of the HTML 4 entity set that older defaults use.

Wrong charset

If the third argument does not match the actual encoding of the string, PHP may return an empty string rather than an error — which looks like a total failure rather than a mismatch.

Pass 'UTF-8' explicitly and make sure the input really is UTF-8. A Latin-1 string mislabelled as UTF-8 is a frequent cause of empty output.

Double encoding

If the source contains  , one decode gives you the literal text   — which looks exactly like nothing happened. Decoding again would produce the space, and that is precisely the pattern you must not automate.

Find where the double encoding happens instead. It is usually a value escaped once before storage and once on output.

It was never an entity

Entities require a trailing semicolon in most contexts. &nbsp without it may render in a browser through error recovery but will not decode.

Invented entities do not decode either — &arrow; is not in the HTML5 set no matter how reasonable it looks. Check the name against the specification, or use the numeric form.

And if the string is already decoded, a non-breaking space (U+00A0) looks identical to a regular space in most editors. Check the byte values before concluding the decode failed.

Frequently asked questions

Why do quotes stay encoded?

ENT_QUOTES was not passed. Add it, together with ENT_HTML5 for '.

Why does the function return an empty string?

The charset argument does not match the input encoding.

Should I decode repeatedly until nothing changes?

No. That is a security bug — it can turn escaped text into executable markup.

Ready to try it?

Open the free browser-based HTML entity encode/decode and apply what you just read — no sign-up, runs locally.

Open the HTML entity encode/decode tool