Decode entities in node titles

Question

I have a few node titles that are being saved with & and displaying that way too.

Is there any way to not encode them while being saved? I tried:

$node = node_load(727);
$node->title = html_entity_decode($node->title);
node_save($node);

I dump out the node and the title is corrected, but is not saved that way. Should I only try to correct the display using the same function?

Answer 1

Filter input, escape output. You can't be sure that everything in your database is safe.