Fix handling of hex-encoded character references

This is necessary when Markdown processing is switched off.

Fixes #34393

Backported from master branch (cherry picked from commit
1004277)

core/string_api.php

@@ -901,7 +901,7 @@ function string_html_specialchars( $p_string ) {
 	# achumakov: @ added to avoid warning output in unsupported codepages
 	# e.g. 8859-2, windows-1257, Korean, which are treated as 8859-1.
 	# This is VERY important for Eastern European, Baltic and Korean languages
-	return preg_replace( '/&(#[0-9]+|[a-z]+);/i', '&$1;', @htmlspecialchars( $p_string, ENT_COMPAT, 'utf-8' ) );
+	return preg_replace( '/&(#x?[0-9]+|[a-z]+);/i', '&$1;', @htmlspecialchars( $p_string, ENT_COMPAT, 'utf-8' ) );
 }
 
 /**