You're applying `html_decode`, but you're not re-encoding it later.  I imagine you could speak HTML, assuming enough of the text doesn't get converted to stars.