I have a Channel Form on the frontend that contains a WYGWAM field. The field works fine unless I add an apostrophe.

If I do, after hitting submit, it hangs and I get a "504 Gateway Time-out" error.

I can add other symbols like quotes, dashes, question marks, etc. without issue. Clicking the WYGWAM source button, I see it is displaying correctly '. I am using the basic {field:event_description} code, nothing special.

Other fields in the form (not WYGWAM) work fine and I can add apostrophes to those fields without errors. The issue is also only on the front end and not in the control panel where I can add apostrophes there.

I am using EE 2.7.3 and WYGWAM 3.2.2

1 Answer 1


The problem lies in updating expression engine to the latest version. 2.7.3 here’s the code i changed in /system/codeigniter/system/core/Security.php

Current function in 2.7.3

public function entity_decode($str, $charset = NULL)
    if (strpos($str, '&') === FALSE)
            return $str;

    if (empty($charset))
            $charset = config_item('charset');

        $matches = $matches1 = 0;

        $str = preg_replace('~(&#x0*[0-9a-f]{2,5});?~iS', '$1;', $str, -1, $matches);
        $str = preg_replace('~(&#\d{2,4});?~S', '$1;', $str, -1, $matches1);
        $str = html_entity_decode($str, ENT_COMPAT, $charset);
    while ($matches OR $matches1);

    return $str;

/*Old function earlier function EE -- This does the trick! -- */

public function entity_decode($str, $charset='UTF-8')
    if (stristr($str, '&') === FALSE) return $str;

    // The reason we are not using html_entity_decode() by itself is because
    // while it is not technically correct to leave out the semicolon
    // at the end of an entity most browsers will still interpret the entity
    // correctly.  html_entity_decode() does not convert entities without
    // semicolons, so we are left with our own little solution here. Bummer.

    if (function_exists('html_entity_decode') && 
        (strtolower($charset) != 'utf-8'))
        $str = html_entity_decode($str, ENT_COMPAT, $charset);
        $str = preg_replace('~&#x(0*[0-9a-f]{2,5})~ei', 'chr(hexdec("\\1"))', $str);
        return preg_replace('~&#([0-9]{2,4})~e', 'chr(\\1)', $str);

    // Numeric Entities
    $str = preg_replace('~&#x(0*[0-9a-f]{2,5});{0,1}~ei', 'chr(hexdec("\\1"))', $str);
    $str = preg_replace('~&#([0-9]{2,4});{0,1}~e', 'chr(\\1)', $str);

    // Literal Entities - Slightly slow so we do another check
    if (stristr($str, '&') === FALSE)
        $str = strtr($str, array_flip(get_html_translation_table(HTML_ENTITIES)));

    return $str;
  • Thank you Raoul! I had almost given up on this. This worked! Feb 20, 2014 at 10:41
  • If this is a bug in the EE core, it really should be submitted to EllisLab through the bug tracker: support.ellislab.com/bugs Feb 20, 2014 at 17:13
  • This bug fix fixes it for me in EE 2.8.0.
    – Simon Job
    Aug 6, 2014 at 11:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.