Fix for sanitize('&#x27;') returning '&amp;#x27;' instead of '&#x27;'