htmlspecialchars($string, ENT_XML1 | ENT_QUOTES, 'UTF-8');// will convert ' to ' in addition to &, <, > and "( not | )