These invalid entities They are actually valid in HTML 4 (and I suppose HTML5 too), but in this case the entities must be with a semicolon so that PHP recognizes them:
$string = 'It';
htmlspecialchars_decode() only decodes < , > , & , ' and " (and the last two depend on the quotes flag).
source share