Sometimes software gets data with no encoding specified, or with wrong encoding. May be result of a bug, transmission glitch or attempt at hacking the software.

Sometimes software gets data with no encoding specified, or with wrong encoding. May be result of a bug, transmission glitch or attempt at hacking the software. As jrockway wrote, you can't trust data from user. The software must handle every input in a predictable way. For wrong encoding, it may stop and signal error, or may continue processing the data -- depends on owner's wishes. But must not do anything stupid, no undefined behavior. Where doing something stupid could be giving user information he may not access (like SQL injections; IIRC wrongly-encoded data was successfully used for SQL injections by fooling code that should escape it), damaging data stored in system or saving invalid data if that would break consistency or any work later on. Two things to be done: 1) instruct browser and other systems that work with your software to send and read UTF-8 2) handle situations when something else is sent instead With UTF-8, the 2) is mostly done by PHP's mb_...() functions, IF configured correctly.