Is there a reason why the call to htmlspecialchars by zen_db_output (/includes/functions/functions_general.php) doesn't include the ENT_COMPAT and CHARSET parameters?
Code:
////
  function zen_db_output($string) {
    return htmlspecialchars($string);
  }