function realCharForNumericEntities($matches)
{
	$newstringnumentity = $matches[1];
	//print  '$newstringnumentity='.$newstringnumentity;

	if (preg_match('/^x/i', $newstringnumentity)) {
		$newstringnumentity = hexdec(preg_replace('/;$/', '', preg_replace('/^x/i', '', $newstringnumentity)));
	}

	// The numeric value we don't want as entities because they encode ascii char, and why using html entities on ascii except for haking ?
	if (($newstringnumentity >= 65 && $newstringnumentity <= 90) || ($newstringnumentity >= 97 && $newstringnumentity <= 122)) {
		return chr((int) $newstringnumentity);
	}

	return '&#'.$matches[1];	// Value will be unchanged because regex was /&#(  )/
}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.