The htmlspecialchars() function filters user input!

<?php

header("content-type:text/html;charset=utf-8");//设置编码，解决中文乱码

$string = "ggbiji & 'ggbiji'";

$string1 = htmlspecialchars($string, ENT_COMPAT); // 默认，仅编码双引号

$string2 = htmlspecialchars($string, ENT_QUOTES); // 编码双引号和单引号

$string3 = htmlspecialchars($string, ENT_NOQUOTES); // 不编码任何引号

echo $string1."<br/>\n";

echo $string2."<br/>\n";

echo $string3."<br/>\n";

?>

Selection of function default values:

htmlspecialchars($string, ENT_COMPAT); //Default, only double quotes are encoded

htmlspecialchars($string, ENT_QUOTES); // Encode double quotes and single quotes

htmlspecialchars($string, ENT_NOQUOTES); // Do not encode any quotes