This happens on a Drupal 7.26 using the default theme when previewing a comment. The '
part is equivalent to an apostrophe. What I don't know if this is something that is part of Drupal to prevent exploits or if this is a bug that should be fixed. I tried searching the Drupal.org forums if this is a bug, I wasn't able to find anything relevant.
1 Answer
Interesting problem to solve ... Here are the findings of above problem.. I do see this issue in latest Drupal.. I believe it's a bug since check_plain method is not used in any other comment rendering features where as we can see proper name while viewing comment...
Comment preview is rendered from comment_preview function defined in 2062 Line in comment module..
/**
* Generate a comment preview.
*/
function comment_preview($comment) {
global $user;
drupal_set_title(t('Preview comment'), PASS_THROUGH);
$node = node_load($comment->nid);
if (!form_get_errors()) {
$comment_body = field_get_items('comment', $comment, 'comment_body');
$comment->format = $comment_body[0]['format'];
// Attach the user and time information.
if (!empty($comment->name)) {
$account = user_load_by_name($comment->name);
}
elseif ($user->uid && empty($comment->is_anonymous)) {
$account = $user;
}
if (!empty($account->uid)) {
$comment->uid = $account->uid;
$comment->name = check_plain($account->name);
$comment->signature = $account->signature;
$comment->signature_format = $account->signature_format;
$comment->picture = $account->picture;
}
elseif (empty($comment->name)) {
$comment->name = variable_get('anonymous', t('Anonymous'));
}
$comment->created = !empty($comment->created) ? $comment->created : REQUEST_TIME;
$comment->changed = REQUEST_TIME;
$comment->in_preview = TRUE;
$comment_build = comment_view($comment, $node);
$comment_build['#weight'] = -100;
$form['comment_preview'] = $comment_build;
}
if ($comment->pid) {
$build = array();
if ($comments = comment_load_multiple(array($comment->pid), array('status' => COMMENT_PUBLISHED))) {
$parent_comment = $comments[$comment->pid];
$build = comment_view($parent_comment, $node);
}
}
else {
$build = node_view($node);
}
$form['comment_output_below'] = $build;
$form['comment_output_below']['#weight'] = 100;
return $form;
}
As you can see
$comment->name = check_plain($account->name);
Comment name is rendered using above statement which takes $account->name as input and wraps using check_plain function which "Encodes special characters in a plain-text string for display as HTML."
Coming to the solution..
- Comment Preview is rendered using Comment_view Function which gives us hook "hook_comment_view"
- By Implementing above hook in your custom module you can check for $account->name and use htmlspecialchars_decode to decode back to original value...