1

My theme has a file:

app/design/{theme}/default/template/sales/order/view.phtml

Around line 78:

<?php if (count($_history)): ?>
<div class="order-additional order-comments">
    <h2 class="sub-title"><?php echo $this->__('About Your Order') ?></h2>
    <dl class="order-about">
        <?php foreach ($_history as $_historyItem): ?>
            <dt><?php echo $this->formatDate($_historyItem->getCreatedAtStoreDate(), 'medium', true) ?></dt>
            <dd><?php echo $this->escapeHtml($_historyItem->getComment()) ?></dd>
        <?php endforeach; ?>
    </dl>
</div>
<?php endif; ?>

Our comments include HTML tags. Is it safe for me to remove the $this->escapeHtml() method so that the HTML is rendered on this page on the frontend?

2

As long as you don't have an extension that allows customers to add comments on their own, the worst that can happen is that the layout breaks when automatically generated comments contain < or >.

But to be safe, I'd recommend to use the second parameter of escapeHtml(), $allowedTags, for example with:

$this->escapeHtml($_historyItem->getComment(), array('p', 'strong', 'em'));

Note, that this will allow

  • <p>paragraph</p>

But not

  • <p onclick="alert()">paragraph</p>
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.