It works, but you expect something else.
The result is interpreted by your browser as HTML. You can get simple output by setting the content type to equal or using the command line.
<?php
header('Content-Type: text/plain');
var_dump(htmlspecialchars("<a href='test'>Test</a>", ENT_QUOTES, 'UTF-8'));
echo htmlspecialchars("<a href='test'>Test</a>", ENT_XHTML, 'UTF-8');
source
share