Index: includes/bootstrap.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/bootstrap.inc,v
retrieving revision 1.289
diff -u -p -r1.289 bootstrap.inc
--- includes/bootstrap.inc	14 Jul 2009 10:22:15 -0000	1.289
+++ includes/bootstrap.inc	18 Jul 2009 18:02:42 -0000
@@ -1024,11 +1024,18 @@ function drupal_unpack($obj, $field = 'd
 /**
  * Encode special characters in a plain-text string for display as HTML.
  *
- * Uses drupal_validate_utf8 to prevent cross site scripting attacks on
- * Internet Explorer 6.
+ * @param $text
+ *   The text to be checked or processed.
+ * @return
+ *   An HTML safe version of $text, or an empty string if $text is not
+ *   valid UTF-8. @see drupal_validate_utf8().
  */
 function check_plain($text) {
-  return drupal_validate_utf8($text) ? htmlspecialchars($text, ENT_QUOTES) : '';
+  // Validate strings as UTF-8 to prevent cross site scripting attacks on
+  // Internet Explorer 6. We duplicate the same preg_match() here to avoid
+  // additional function calls, since check_plain() is often called hundreds of
+  // times per request.
+  return (preg_match('/^./us', $text) == 1) ? htmlspecialchars($text, ENT_QUOTES) : '';
 }
 
 /**
@@ -1055,9 +1062,6 @@ function check_plain($text) {
  *   TRUE if the text is valid UTF-8, FALSE if not.
  */
 function drupal_validate_utf8($text) {
-  if (strlen($text) == 0) {
-    return TRUE;
-  }
   // With the PCRE_UTF8 modifier 'u', preg_match() fails silently on strings
   // containing invalid UTF-8 byte sequences. It does not reject character
   // codes above U+10FFFF (represented by 4 or more octets), though.
Index: includes/common.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/common.inc,v
retrieving revision 1.935
diff -u -p -r1.935 common.inc
--- includes/common.inc	15 Jul 2009 17:40:17 -0000	1.935
+++ includes/common.inc	18 Jul 2009 18:02:45 -0000
@@ -1345,8 +1345,8 @@ function filter_xss_admin($string) {
  */
 function filter_xss($string, $allowed_tags = array('a', 'em', 'strong', 'cite', 'blockquote', 'code', 'ul', 'ol', 'li', 'dl', 'dt', 'dd')) {
   // Only operate on valid UTF-8 strings. This is necessary to prevent cross
-  // site scripting issues on Internet Explorer 6.
-  if (!drupal_validate_utf8($string)) {
+  // site scripting issues on Internet Explorer 6. @see drupal_validate_utf8().
+  if (!preg_match('/^./us', $text) == 1) {
     return '';
   }
   // Store the text format