always use charset config item
diff --git a/system/core/Security.php b/system/core/Security.php
index 342455f..cc21ddc 100755
--- a/system/core/Security.php
+++ b/system/core/Security.php
@@ -525,9 +525,10 @@
* @param string
* @return string
*/
- public function entity_decode($str, $charset='UTF-8')
+ public function entity_decode($str, $charset = NULL)
{
if (stristr($str, '&') === FALSE) return $str;
+ if (empty($charset)) $charset = config_item('charset');
// The reason we are not using html_entity_decode() by itself is because
// while it is not technically correct to leave out the semicolon