Add ENT_SUBSTITUTE flag for safer HTML entity decoding

Co-authored-by: thorsten <[email protected]>

Author: Copilot

phpmyfaq/src/phpMyFAQ/User/UserData.php

@@ -79,7 +79,11 @@ public function get(mixed $field): mixed
 
         // Decode HTML entities in display_name for backward compatibility
         if (isset($array['display_name'])) {
-            $array['display_name'] = html_entity_decode($array['display_name'], ENT_QUOTES | ENT_HTML5, 'UTF-8');
+            $array['display_name'] = html_entity_decode(
+                $array['display_name'],
+                ENT_QUOTES | ENT_HTML5 | ENT_SUBSTITUTE,
+                'UTF-8'
+            );
         }
 
         return $singleReturn && $field != '*' ? $array[$field] : $array;