update don't trust the users

add an html_entity_decode()
update

quick correction