protected function _validate_entities($str) {
		/*
		 * Protect GET variables in URLs
		 */
		
		// 901119URL5918AMP18930PROTECT8198
		
		$str = preg_replace('|\&([a-z\_0-9\-]+)\=([a-z\_0-9\-]+)|i', $this->xss_hash() . "\\1=\\2", $str);
		
		/*
		 * Validate standard character entities Add a semicolon if missing. We
		 * do this to enable the conversion of entities to ASCII later.
		 */
		$str = preg_replace('#(&\#?[0-9a-z]{2,})([\x00-\x20])*;?#i', "\\1;\\2", $str);
		
		/*
		 * Validate UTF16 two byte encoding (x00) Just as above, adds a
		 * semicolon if missing.
		 */
		$str = preg_replace('#(&\#x?)([0-9A-F]+);?#i', "\\1\\2;", $str);
		
		/*
		 * Un-Protect GET variables in URLs
		 */
		$str = str_replace($this->xss_hash(), '&', $str);
		
		return $str;
	}