$str = str_replace("{title}",htmlentities($row[title],ENT_NOQUOTES, 'utf-8'),$str);
$str = str_replace("{title}",$row[title],$str);