-} # function wp_kses_normalize_entities
-
-function wp_kses_normalize_entities2($i)
-###############################################################################
-# This function helps wp_kses_normalize_entities() to only accept 16 bit values
-# and nothing more for &#number; entities.
-###############################################################################
-{
- return (($i > 65535) ? "&#$i;" : "&#$i;");
-} # function wp_kses_normalize_entities2
-
-function wp_kses_decode_entities($string)
-###############################################################################
-# This function decodes numeric HTML entities (A and A). It doesn't
-# do anything with other entities like ä, but we don't need them in the
-# URL protocol whitelisting system anyway.
-###############################################################################
-{
- $string = preg_replace('/&#([0-9]+);/e', 'chr("\\1")', $string);
- $string = preg_replace('/&#[Xx]([0-9A-Fa-f]+);/e', 'chr(hexdec("\\1"))', $string);
+}
+
+/**
+ * Callback for wp_kses_normalize_entities() regular expression.
+ *
+ * This function helps wp_kses_normalize_entities() to only accept 16 bit values
+ * and nothing more for &#number; entities.
+ *
+ * @access private
+ * @since 1.0.0
+ *
+ * @param array $matches preg_replace_callback() matches array
+ * @return string Correctly encoded entity
+ */
+function wp_kses_normalize_entities2($matches) {
+ if ( ! isset($matches[1]) || empty($matches[1]) )
+ return '';
+
+ $i = $matches[1];
+ return ( ( ! valid_unicode($i) ) || ($i > 65535) ? "&#$i;" : "&#$i;" );
+}
+
+/**
+ * Callback for wp_kses_normalize_entities() for regular expression.
+ *
+ * This function helps wp_kses_normalize_entities() to only accept valid Unicode
+ * numeric entities in hex form.
+ *
+ * @access private
+ *
+ * @param array $matches preg_replace_callback() matches array
+ * @return string Correctly encoded entity
+ */
+function wp_kses_normalize_entities3($matches) {
+ if ( ! isset($matches[2]) || empty($matches[2]) )
+ return '';
+
+ $hexchars = $matches[2];
+ return ( ( ! valid_unicode(hexdec($hexchars)) ) ? "&#x$hexchars;" : "&#x$hexchars;" );
+}
+
+/**
+ * Helper function to determine if a Unicode value is valid.
+ *
+ * @param int $i Unicode value
+ * @return bool true if the value was a valid Unicode number
+ */
+function valid_unicode($i) {
+ return ( $i == 0x9 || $i == 0xa || $i == 0xd ||
+ ($i >= 0x20 && $i <= 0xd7ff) ||
+ ($i >= 0xe000 && $i <= 0xfffd) ||
+ ($i >= 0x10000 && $i <= 0x10ffff) );
+}
+
+/**
+ * Convert all entities to their character counterparts.
+ *
+ * This function decodes numeric HTML entities (A and A). It doesn't do
+ * anything with other entities like ä, but we don't need them in the URL
+ * protocol whitelisting system anyway.
+ *
+ * @since 1.0.0
+ *
+ * @param string $string Content to change entities
+ * @return string Content after decoded entities
+ */
+function wp_kses_decode_entities($string) {
+ $string = preg_replace_callback('/&#([0-9]+);/', create_function('$match', 'return chr($match[1]);'), $string);
+ $string = preg_replace_callback('/&#[Xx]([0-9A-Fa-f]+);/', create_function('$match', 'return chr(hexdec($match[1]));'), $string);