changed entity standardization to require at least two characters after an ampersand before forcing a semi-colon
diff --git a/system/libraries/Input.php b/system/libraries/Input.php
index 24c6c19..ff1dd9b 100644
--- a/system/libraries/Input.php
+++ b/system/libraries/Input.php
@@ -547,7 +547,7 @@
* the conversion of entities to ASCII later.
*
*/
- $str = preg_replace('#(&\#?[0-9a-z]+)[\x00-\x20]*;?#i', "\\1;", $str);
+ $str = preg_replace('#(&\#?[0-9a-z]{2,})[\x00-\x20]*;?#i', "\\1;", $str);
/*
* Validate UTF16 two byte encoding (x00)