| Index: trunk/phase3/includes/Sanitizer.php |
| — | — | @@ -1059,11 +1059,10 @@ |
| 1060 | 1060 | * @return String: escaped input |
| 1061 | 1061 | */ |
| 1062 | 1062 | static function escapeHtmlAllowEntities( $html ) { |
| | 1063 | + $html = Sanitizer::decodeCharReferences( $html ); |
| 1063 | 1064 | # It seems wise to escape ' as well as ", as a matter of course. Can't |
| 1064 | 1065 | # hurt. |
| 1065 | 1066 | $html = htmlspecialchars( $html, ENT_QUOTES ); |
| 1066 | | - $html = str_replace( '&', '&', $html ); |
| 1067 | | - $html = Sanitizer::decodeCharReferences( $html ); |
| 1068 | 1067 | return $html; |
| 1069 | 1068 | } |
| 1070 | 1069 | |