diff --git a/system/core/Security.php b/system/core/Security.php
index 342455f..cc21ddc 100755
--- a/system/core/Security.php
+++ b/system/core/Security.php
@@ -525,9 +525,10 @@
 	 * @param	string
 	 * @return	string
 	 */
-	public function entity_decode($str, $charset='UTF-8')
+	public function entity_decode($str, $charset = NULL)
 	{
 		if (stristr($str, '&') === FALSE) return $str;
+		if (empty($charset)) $charset = config_item('charset');
 
 		// The reason we are not using html_entity_decode() by itself is because
 		// while it is not technically correct to leave out the semicolon