How to Create Dynamic Meta Tags in PHP: A Security-First Guide

Creating dynamic meta tags in PHP means generating the title, description, and Open Graph tags for each page from real data, a database row, a route parameter, a CMS field, instead of hardcoding the same static tags across every page. Done wrong, this becomes a genuine security hole. Done right, it's the difference between a blue, un-clickable link and a rich card people actually tap.

01Dynamic Meta Tags in PHP: The Core Pattern

The fundamental pattern is consistent across every implementation worth copying: fetch the page-specific data early, before any HTML output begins, provide a sensible fallback if that data is missing, then escape every single value before it touches the page.

That last step is the one most tutorials gloss over, and it's exactly where real vulnerabilities show up in production. Server-side rendering also matters for a separate reason: relying on client-side JavaScript to inject meta tags is far less predictable for crawlers and for users who view source or have JavaScript disabled.

02Basic Dynamic Title and Description

A widely used pattern from real-world PHP forums fetches meta values from a database using a prepared statement, then falls back to site-wide defaults if no row exists for that page.

<?php
// Assume $pdo is a PDO instance connected earlier
$page = basename($_SERVER['SCRIPT_NAME'], '.php');

$stmt = $pdo->prepare(
  'SELECT meta_title, meta_description FROM page_meta WHERE page_key = ? LIMIT 1'
);
$stmt->execute([$page]);
$row = $stmt->fetch(PDO::FETCH_ASSOC) ?: [];

// Fall back to site defaults when no row exists
$title = $row['meta_title'] ?? 'Default Site Title';
$description = $row['meta_description'] ?? 'Default site description.';
?>
<title><?= htmlspecialchars($title, ENT_QUOTES, 'UTF-8') ?></title>
<meta name="description" content="<?= htmlspecialchars($description, ENT_QUOTES, 'UTF-8') ?>">

03Why htmlspecialchars() Isn't Optional

SecureFlag's security knowledge base is explicit about the mechanism: PHP's built-in htmlspecialchars() and htmlentities() encode problematic characters in output specifically to prevent XSS vulnerabilities, converting characters like <, >, and quotes into their safe HTML entity equivalents before the browser ever sees them as markup.

The flag matters as much as the function call itself. FlatCoding's guide is specific: by default, htmlspecialchars() only converts double quotes, leaving single quotes untouched. Since meta tag content sits inside a double-quoted HTML attribute, an unescaped single quote alone won't break things, but any dynamic value that could end up in a single-quoted context needs ENT_QUOTES to convert both quote types.

04Adding Dynamic Open Graph Tags

RichDevTools' guide notes what Open Graph tags actually control: how a page renders as a card when shared on Slack, Facebook, LinkedIn, or Discord. A clean pattern loops over an associative array of properties, escaping each value the same way as the title and description.

<?php
$ogTags = [
  'og:title'       => $article->title,
  'og:description' => $article->excerpt,
  'og:image'       => $article->ogImageUrl,
  'og:url'         => $article->canonicalUrl,
  'og:type'        => 'article',
  'og:site_name'   => 'Brandella Journal',
];

foreach ($ogTags as $property => $content) {
  echo '<meta property="' . htmlspecialchars($property, ENT_QUOTES, 'UTF-8')
     . '" content="' . htmlspecialchars($content, ENT_QUOTES, 'UTF-8')
     . '">' . PHP_EOL;
}
?>

05Safely Truncating Long Dynamic Content

Database-sourced descriptions are often longer than the SERP display limit. Truncating with a plain substr() risks cutting a word in half, or worse, splitting a multi-byte UTF-8 character and corrupting the output entirely.

function truncateMetaDescription($text, $maxLength = 155) {
  $text = trim($text);

  if (mb_strlen($text, 'UTF-8') <= $maxLength) {
    return $text;
  }

  // mb_ functions are essential here to avoid breaking multi-byte characters
  $truncated = mb_substr($text, 0, $maxLength, 'UTF-8');

  // Trim back to the last full word to avoid a mid-word cut
  $lastSpace = mb_strrpos($truncated, ' ', 0, 'UTF-8');
  if ($lastSpace !== false) {
    $truncated = mb_substr($truncated, 0, $lastSpace, 'UTF-8');
  }

  return $truncated . '…';
}

06Handling Paginated and Faceted Pages

A meta description that's identical across every page of a paginated series creates duplicate content signals at scale. A common pattern appends the page number directly to the description, keeping each page's meta tags distinguishable.

$currentPage = filter_input(INPUT_GET, 'page', FILTER_VALIDATE_INT) ?: 1;

$description = truncateMetaDescription($baseDescription, 140);

if ($currentPage > 1) {
  $description .= " — Page {$currentPage}";
}

// For highly dynamic pages like search results or faceted filters,
// consider noindex instead of trying to write a unique description for each combination
if ($isFacetedSearchPage) {
  echo '<meta name="robots" content="noindex, follow">';
}

This connects directly to canonical tag strategy for pagination, which our canonical tag implementation guide covers in depth, each paginated page should self-reference its own canonical rather than pointing back to page one.

07htmlspecialchars() Flags Compared

Choosing the right escaping flag matters more than most tutorials suggest.

08Implementation Checklist

A short list to confirm before shipping dynamic meta tags to production.

09Common Questions