CI_Security::entity_decode()

entity_decode($str[, $charset = NULL])

This method acts a lot like PHP’s own native html_entity_decode() function in ENT_COMPAT mode, only it tries to detect HTML entities that don’t end in a semicolon because some browsers allow that.

If the $charset parameter is left empty, then your configured $config['charset'] value will be used.