How to avoid HTML characters in contact form?

Question

The problem is when user submit the form with special characters in the contact form (description field), in the mail it converts to HTML characters. After lot of debugging I nailed down the following file.

\vendor\magento\module-contact\view\adminhtml\email\submitted_form.html

the file contains

{{trans "Name: %name" name=$data.name}}
{{trans "Email: %email" email=$data.email}}
{{trans "Phone Number: %telephone" telephone=$data.telephone}}

{{trans "Comment: %comment" comment=$data.comment}}

I tried wrapping up %comment/$data.comment field with htmlspecialchars/ htmlentities functions. but it's not working.

For example, If I entered the following word (Hello' world") in the contact form, I receive as

Hello' world"

Answer 1

You need to restrict the special character's using javascript in form element.

var valid = (e.which >= 48 && e.which <= 57) || (e.which >= 65 && e.which <= 90) || (e.which >= 97 && e.which <= 122); if (!valid) { e.preventDefault(); }