Since I updated to Drupal 7.53 the function drupal_set_message does not work anymore as expected, as it encodes or strips all HTML tags. For example the code:

drupal_set_message("<b>This is important,</b> this not.");

used to print:

This is important, this not

But since the update it prints:

This is important, this not.

I could not find any change to that functions mentioned in the release messages. Can anybody explain to me what has happened?

By the way, I am using the Bootstrap theme, what was updates as well. Maybe the Theme is to blame?

2 Answers 2


The messages added with drupal_set_message() are rendered in the page.tpl.php template file of the theme, if the file it is using one; otherwise, they are rendered through the template file defined from the System module.

By default, the System module and the core themes use the following code to print them.

<?php print $messages; ?>

There could be some HTML markup to wrap them, as in the Bartik theme, but that should not have the effect you are seeing.

  <?php if ($messages): ?>
    <div id="messages"><div class="section clearfix">
      <?php print $messages; ?>
    </div></div> <!-- /.section, /#messages -->
  <?php endif; ?>

The way those messages are printed has not been changed from recent updates to Drupal core, so I would check the used theme and any installed (and enabled) modules to find out what is happening.

Apart from looking the page.tpl.php template file used from your theme, you should check the implementation of theme_status_messages() (which is normally called from template_preprocess_page()) done from the theme you are using, any preprocess function for theme_status_messages() (hook_preprocess_status_messages()), and any preprocess function used for the page.tpl.php template file (hook_preprocess_page()). Keep in mind that preprocess functions can be implemented by any module, or the theme used for the rendered page.

As side note, it is usually better to use t() and its placeholders, with drupal_set_message().

drupal_set_message(t("!important. This not.", array('!important' => '<b>This is important</b>')));

If you don't need to translate the message (e.g. because it is a debugging message), you could use [format_string()][5].

drupal_set_message(format_string("!important. This not.", array('!important' => '<b>This is important</b>')));

The problem relies on bootstrap theme. In the 'templates\system' folder there is the status-messages.func.php file where the messages are altered by the _bootstrap_filter_xss() function in terms of cross-site-scripting (XSS) vulnerabilities (as it described here).

You can read a similar issue here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.