simplified regex for _remove_invisible_characters() - since we rawurldecode() the string, there's no need to go looking for url encoded characters here
diff --git a/user_guide/changelog.html b/user_guide/changelog.html
index 8149b7c..6697856 100644
--- a/user_guide/changelog.html
+++ b/user_guide/changelog.html
@@ -63,7 +63,11 @@
SVN Revision: XXXX</p>
<ul>
- <li>No significant changes yet</li>
+ <li>Other changes
+ <ul>
+ <li>Improved performance and accuracy of xss_clean() (no changes to security)</li>
+ </ul>
+ </li>
</ul>
<h3>Bug fixes for 1.6.4</h3>