It is necessary to allow links in htmlspecialchars, but not all, but starting with /, for example, /upload/1.png
There is a function
$pureHTML = htmlspecialchars($text, ENT_NOQUOTES); preg_match_all('/(<\s*a)\s*(\w+="[\w:\/@#%_\-&\.]+")\s*(>)/i', $pureHTML, $matches, PREG_SET_ORDER); foreach($matches as $match) { $pureHTML = str_replace($match[0], "<a " . $match[2] . ">", $pureHTML); } $pureHTML = preg_replace('/(<\/\s*a\s*>)/i', '</a>', $pureHTML); In regulars I do not rummage, how to correct? and is this feature safe?