Removing HTML Escape on history item comment

Question

My theme has a file:

app/design/{theme}/default/template/sales/order/view.phtml

Around line 78:

<?php if (count($_history)): ?>
<div class="order-additional order-comments">
    <h2 class="sub-title"><?php echo $this->__('About Your Order') ?></h2>
    <dl class="order-about">
        <?php foreach ($_history as $_historyItem): ?>
            <dt><?php echo $this->formatDate($_historyItem->getCreatedAtStoreDate(), 'medium', true) ?></dt>
            <dd><?php echo $this->escapeHtml($_historyItem->getComment()) ?></dd>
        <?php endforeach; ?>
    </dl>
</div>
<?php endif; ?>

Our comments include HTML tags. Is it safe for me to remove the $this->escapeHtml() method so that the HTML is rendered on this page on the frontend?

Answer 1

As long as you don't have an extension that allows customers to add comments on their own, the worst that can happen is that the layout breaks when automatically generated comments contain < or >.

But to be safe, I'd recommend to use the second parameter of escapeHtml(), $allowedTags, for example with:

$this->escapeHtml($_historyItem->getComment(), array('p', 'strong', 'em'));

Note, that this will allow

• <p>paragraph</p>

But not

• <p onclick="alert()">paragraph</p>