<?php
// Don't do this !
$value = urldecode($_GET['something']);
?>

The fact...

PHP "receives" this as %27, which your urldecode() will convert to ' (the singlequote). This may be CATASTROPHIC when injecting into SQL or some PHP functions relying on escaped quotes -- magic quotes rightly cannot detect this and will not protect you!

Eg. This exploit affects phpBB < 2.0.11

<?php
$query = htmlspecialchars($_GET['query']);  
$query = str_replace('%2522', '', $query);  
$query = str_replace('%27', '', $query);  
$query = str_replace('%2527', '', $query);  
?>

<?php
// good 
str_replace('&amp;', '&', htmlspecialchars($_GET['redirect']);
// bad
htmlspecialchars(urldecode($_GET['redirect']));
?>