diff --git a/includes/common.inc b/includes/common.inc
index 439b382dade22597383f251f94a007db74d7a3f9..cef3e45cad8158c06efa3cf1c705c9a66ea89438 100644
--- a/includes/common.inc
+++ b/includes/common.inc
@@ -1549,6 +1549,10 @@ function filter_xss_bad_protocol($string, $decode = TRUE) {
   // @todo Remove the $decode parameter in Drupal 8, and always assume an HTML
   //   string that needs decoding.
   if ($decode) {
+    if (!function_exists('decode_entities')) {
+      require_once DRUPAL_ROOT . '/includes/unicode.inc';
+    }
+
     $string = decode_entities($string);
   }
   return check_plain(drupal_strip_dangerous_protocols($string));