This happens on a Drupal 7.26 using the default theme when previewing a comment. The &#039 part is equivalent to an apostrophe. What I don't know if this is something that is part of Drupal to prevent exploits or if this is a bug that should be fixed. I tried searching the Drupal.org forums if this is a bug, I wasn't able to find anything relevant.

enter image description here


Interesting problem to solve ... Here are the findings of above problem.. I do see this issue in latest Drupal.. I believe it's a bug since check_plain method is not used in any other comment rendering features where as we can see proper name while viewing comment...

Comment preview is rendered from comment_preview function defined in 2062 Line in comment module..

 * Generate a comment preview.
function comment_preview($comment) {
  global $user;

  drupal_set_title(t('Preview comment'), PASS_THROUGH);

  $node = node_load($comment->nid);

  if (!form_get_errors()) {
    $comment_body = field_get_items('comment', $comment, 'comment_body');
    $comment->format = $comment_body[0]['format'];
    // Attach the user and time information.
    if (!empty($comment->name)) {
      $account = user_load_by_name($comment->name);
    elseif ($user->uid && empty($comment->is_anonymous)) {
      $account = $user;

    if (!empty($account->uid)) {
      $comment->uid = $account->uid;
      $comment->name = check_plain($account->name);
      $comment->signature = $account->signature;
      $comment->signature_format = $account->signature_format;
      $comment->picture = $account->picture;
    elseif (empty($comment->name)) {
      $comment->name = variable_get('anonymous', t('Anonymous'));

    $comment->created = !empty($comment->created) ? $comment->created : REQUEST_TIME;
    $comment->changed = REQUEST_TIME;
    $comment->in_preview = TRUE;
    $comment_build = comment_view($comment, $node);
    $comment_build['#weight'] = -100;

    $form['comment_preview'] = $comment_build;

  if ($comment->pid) {
    $build = array();
    if ($comments = comment_load_multiple(array($comment->pid), array('status' => COMMENT_PUBLISHED))) {
      $parent_comment = $comments[$comment->pid];
      $build = comment_view($parent_comment, $node);
  else {
    $build = node_view($node);

  $form['comment_output_below'] = $build;
  $form['comment_output_below']['#weight'] = 100;

  return $form;

As you can see

$comment->name = check_plain($account->name);

Comment name is rendered using above statement which takes $account->name as input and wraps using check_plain function which "Encodes special characters in a plain-text string for display as HTML."

Coming to the solution..

  • Comment Preview is rendered using Comment_view Function which gives us hook "hook_comment_view"
  • By Implementing above hook in your custom module you can check for $account->name and use htmlspecialchars_decode to decode back to original value...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.