Index: includes/common.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/common.inc,v
retrieving revision 1.925
diff -u -r1.925 common.inc
--- includes/common.inc	18 Jun 2009 21:19:01 -0000	1.925
+++ includes/common.inc	28 Jun 2009 14:32:24 -0000
@@ -1359,12 +1359,12 @@
   // Defuse all HTML entities
   $string = str_replace('&', '&', $string);
   // Change back only well-formed entities in our whitelist
-  // Named entities
-  $string = preg_replace('/&([A-Za-z][A-Za-z0-9]*;)/', '&\1', $string);
   // Decimal numeric entities
   $string = preg_replace('/&#([0-9]+;)/', '&#\1', $string);
   // Hexadecimal numeric entities
   $string = preg_replace('/&#[Xx]0*((?:[0-9A-Fa-f]{2})+;)/', '&#x\1', $string);
+  // Named entities
+  $string = preg_replace('/&([A-Za-z][A-Za-z0-9]*;)/', '&\1', $string);
 
   return preg_replace_callback('%
     (
Index: modules/filter/filter.test
===================================================================
RCS file: /cvs/drupal/drupal/modules/filter/filter.test,v
retrieving revision 1.24
diff -u -r1.24 filter.test
--- modules/filter/filter.test	28 Jun 2009 12:01:26 -0000	1.24
+++ modules/filter/filter.test	28 Jun 2009 14:32:38 -0000
@@ -394,6 +394,15 @@
 
     $f = filter_xss("\xc0aaa");
     $this->assertEqual($f, '', t('HTML filter -- overlong UTF-8 sequences.'));
+
+    $f = filter_xss("Who's Online");
+    $this->assertNormalized($f, "who's online", t('HTML filter -- html entity number'));
+
+    $f = filter_xss("Who's Online");
+    $this->assertNormalized($f, "who's online", t('HTML filter -- encoded html entity number'));
+
+    $f = filter_xss("Who' Online");
+    $this->assertNormalized($f, "who' online", t('HTML filter -- double encoded html entity number'));
   }
 
   /**