---
title: "FILTER_SANITIZE_STRING is deprecated, what to use instead?"
author: "Lax Mariappan"
date: "2022-09-08"
categories: ["PHP"]
excerpt: "Use htmlspecialchars() to filter HTML entities in a string instead of FILTER_SANITIZE_STRING"
canonical_url: "https://laxmariappan.com/filter_sanitize_string-is-deprecated-what-to-use-instead/"
---

# FILTER_SANITIZE_STRING is deprecated, what to use instead?

As PHP 8.1.0 FILTER_SANITIZE_STRING is deprecated. Let’s see what function should you use instead.

What is FILTER_SANITIZE_STRING?

This sanitization filter allows you to strip tags and HTML-encode double and single quotes. You can also strip or encode special characters. 

If you are using this on PHP 8.1.0 or above you will get a deprecated warning.

Deprecated warning of FILTER_SANITIZE_STRING in VS code with intelephense extension

htmlspecialchars

The official PHP documentation recommends htmlspecialchars instead of FILTER_SANITIZE_STRING

Let’s take a look at some examples

$string_1 = htmlspecialchars("<h2>some heading</h2>", ENT_QUOTES); 
// &lt;h2&gt;some heading&lt;/h2&gt;

$string_2 = html_entity_decode($string_1); // <h2>some heading</h2>Code language: HTML, XML (xml)

$string_3 = "<h2>some heading</h2>";

filter_var ( $string_3, FILTER_SANITIZE_STRING); // <h2>some heading</h2>Code language: HTML, XML (xml)

So if you want to sanitize a string and remove or encode HTML characters use htmlspecialcharsFurther reading:PHP official docs

https://www.php.net/manual/en/function.htmlspecialchars.php

Why Was FILTER_SANITIZE_STRING Deprecated?

FILTER_SANITIZE_STRING was deprecated as it did not reliably protect against XSS (Cross-Site Scripting) and gave a false sense of security for user input cleaning. See also the discussion on Stack Overflow.

More Practical Sanitization Examples

1. Basic: Convert Special Characters for Safe HTML Output

<?php 
$user_input = "<script>alert('Test!');</script> Hello!";
$safe = htmlspecialchars($user_input, ENT_QUOTES, 'UTF-8');
// Output: &lt;script&gt;alert(&#039;Test!&#039;);&lt;/script&gt; Hello!
Code language: HTML, XML (xml)

See htmlspecialchars manual.

2. Remove All HTML Tags (display as plain text)

<?php 
$user_input = "<h1>Hello <em>world</em>!</h1>";
$stripped = strip_tags($user_input);
<em>// Output: Hello world!</em>Code language: HTML, XML (xml)

More on strip_tags.

3. Combination: Allow Only Safe Tags

<?php $user_input = '<p>Welcome <a href="#">friend</a>!</p>';
// Allow only <a> and <p> tags
$safe = strip_tags($user_input, '<a><p>');
// Output: <p>Welcome <a href="#">friend</a>!</p>Code language: HTML, XML (xml)

Caution: Allowing tags opens up attribute-based XSS; see this Reddit discussion.

4. Escaping Before Database or Email

For output, always escape:

<?php echo htmlspecialchars($comment, ENT_QUOTES, 'UTF-8');Code language: HTML, XML (xml)

For SQL data, always use prepared statements. Best practices at Essential PHP Security Practices.

5. Advanced: Custom Function for Legacy Replacement

If your codebase uses FILTER_SANITIZE_STRING with specific needs, you can create a custom sanitization helper:

<?php 
function sanitize_legacy($value) {
    $value = strip_tags($value);
    return htmlspecialchars($value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
}Code language: HTML, XML (xml)

See more migration tips.

Some more security tips

Always use prepared statements for SQL (details).

Use Content Security Policy (CSP) headers as extra protection.

Validate emails, URLs, and numbers with filter_var($input, FILTER_VALIDATE_*).

Find more in the PHP official docs.