html_entity_decode Twig: Decoding Entities in Templates

Twig escapes output automatically, so needing to decode entities inside a template usually means the data was escaped somewhere it should not have been. Fixing that is better than adding a decode step.

What Twig gives you

There is no html_entity_decode filter built in. |raw switches escaping off, and |striptags is often suggested but does not decode anything: it calls PHP's strip_tags(), which removes tags and leaves & as it is, and autoescaping then turns it into &amp;:

{{ text }}              {# escaped automatically #}
{{ text|raw }}          {# not escaped — only for trusted content #}
{{ text|striptags }}    {# tags removed; entities stay encoded #}

In Symfony, |raw on user-supplied content is how XSS gets introduced. Reach for it only when you produced the HTML yourself and know it is safe.

Adding a filter when you truly need one

If the data genuinely arrives entity-encoded from a third party and you cannot fix the source, register a filter rather than scattering |raw:

// src/Twig/EntityExtension.php
new TwigFilter('decode_entities', fn (string $s): string =>
    html_entity_decode($s, ENT_QUOTES | ENT_HTML5, 'UTF-8')
);

{{ text|decode_entities }} then still passes through Twig autoescaping, so the decoded characters are re-escaped for HTML — which is the safe combination. Decoding and then applying |raw is not.

Fix it upstream instead

The usual root cause is double escaping: an entity-encoded value stored in the database, then escaped again by Twig, so users see &amp; on the page.

Store raw text and let the template layer escape once. If you see literal & in rendered output, look for the code that escaped before storage — that is the bug, and decoding in the template only masks it.

Frequently asked questions

Does Twig have an html_entity_decode filter?

No. Register a small custom filter that calls `html_entity_decode()`. The `|striptags` filter removes tags but leaves entities encoded.

Why does my page show &amp;?

The value was escaped before storage and escaped again by Twig. Store raw text.

Is |raw safe?

Only for HTML you generated and trust. Never for user input.