title: Have I just created a security issue by using str_replace to escape apostrophes?
body: <p>I'm working with a really old "Page Builder" on a clients site. Every time I put some text with an <code>'</code> in it the text is output on the page as <code>\'</code>.</p>
  
  <p>I have tried some different functions but couldn't find a solution except for using the <code>str_replace</code> version below:</p>
  
  <pre><code>$output .= wpautop(do_shortcode(htmlspecialchars_decode(str_replace("\'","'",$service['servicetext']))));
  </code></pre>
  
  <p>Did I just put a security bug into the site? </p>
  
  <p>Can anyone point me to the correct, safe solution?</p>