Don't assume input data is urlencoded when removing invisible characters

When cleaning input data, set url_encode to be false when removing invisible characters. The $_POST, $_GET, and $_COOKIE variables are not urlencoded, but remove_invisible_characters assume that it is and will remove characters such as "%00" unless the url_encoded parameter is set to false.