title: Is it safe to unescape ampersand for user input?
body: <p>After a few hours of bug searching, I found out the cause of one of my most annoying bugs. </p>
  
  <p>When users are typing out a message on my site, they can title it with plaintext and html entities. </p>
  
  <p>This means in some instances, users will type a title with common html entity pictures like this face. ( ͡° ͜ʖ ͡°).</p>
  
  <p>To prevent html injection, I use htmlspecialchars(); on the title, and annoyingly it would convert the picture its html entity format when outputted onto the page later on. </p>
  
  <pre><code>( &amp;#865;° &amp;#860;&amp;#662; &amp;#865;°)
  </code></pre>
  
  <p>I realized the problem here was that the title was being encoded as the example above, and htmlspecialchar, as well as doing what I wanted and encoding possible html injection, was turning the ampersand in the entities to </p>
  
  <pre><code>&amp;amp;. 
  </code></pre>
  
  <p>By un-escaping all the ampersands, and changing them back to &amp; this fixed my problem and the face would come out as expected. </p>
  
  <p>However I am unsure if this is still safe from malicious html. Is it safe to decode the ampersands in user imputed titles? If not, how can I go about fixing this issue?</p>