Author name in comment preview not rendering apostrophe properly: a bug or by-design?

Question

This happens on a Drupal 7.26 using the default theme when previewing a comment. The &#039 part is equivalent to an apostrophe. What I don't know if this is something that is part of Drupal to prevent exploits or if this is a bug that should be fixed. I tried searching the Drupal.org forums if this is a bug, I wasn't able to find anything relevant.

Answer 1

Interesting problem to solve ... Here are the findings of above problem.. I do see this issue in latest Drupal.. I believe it's a bug since check_plain method is not used in any other comment rendering features where as we can see proper name while viewing comment...

Comment preview is rendered from comment_preview function defined in 2062 Line in comment module..

/**
 * Generate a comment preview.
 */
function comment_preview($comment) {
  global $user;

  drupal_set_title(t('Preview comment'), PASS_THROUGH);

  $node = node_load($comment->nid);

  if (!form_get_errors()) {
    $comment_body = field_get_items('comment', $comment, 'comment_body');
    $comment->format = $comment_body[0]['format'];
    // Attach the user and time information.
    if (!empty($comment->name)) {
      $account = user_load_by_name($comment->name);
    }
    elseif ($user->uid && empty($comment->is_anonymous)) {
      $account = $user;
    }

    if (!empty($account->uid)) {
      $comment->uid = $account->uid;
      $comment->name = check_plain($account->name);
      $comment->signature = $account->signature;
      $comment->signature_format = $account->signature_format;
      $comment->picture = $account->picture;
    }
    elseif (empty($comment->name)) {
      $comment->name = variable_get('anonymous', t('Anonymous'));
    }

    $comment->created = !empty($comment->created) ? $comment->created : REQUEST_TIME;
    $comment->changed = REQUEST_TIME;
    $comment->in_preview = TRUE;
    $comment_build = comment_view($comment, $node);
    $comment_build['#weight'] = -100;

    $form['comment_preview'] = $comment_build;
  }

  if ($comment->pid) {
    $build = array();
    if ($comments = comment_load_multiple(array($comment->pid), array('status' => COMMENT_PUBLISHED))) {
      $parent_comment = $comments[$comment->pid];
      $build = comment_view($parent_comment, $node);
    }
  }
  else {
    $build = node_view($node);
  }

  $form['comment_output_below'] = $build;
  $form['comment_output_below']['#weight'] = 100;

  return $form;
}

As you can see

$comment->name = check_plain($account->name);

Comment name is rendered using above statement which takes $account->name as input and wraps using check_plain function which "Encodes special characters in a plain-text string for display as HTML."

Coming to the solution..

• Comment Preview is rendered using Comment_view Function which gives us hook "hook_comment_view"
• By Implementing above hook in your custom module you can check for $account->name and use htmlspecialchars_decode to decode back to original value...