The Magento patch 7405 adds a function to app/code/core/Mage/Adminhtml/Helper/Sales.php that is as follows:

 * Escape string preserving links
 * @param array|string $data
 * @param null|array $allowedTags
 * @return string
public function escapeHtmlWithLinks($data, $allowedTags = null)
    if (!empty($data) && is_array($allowedTags) && in_array('a', $allowedTags)) {
        $links = [];
        $i = 1;
        $regexp = "/<a\s[^>]*href\s*?=\s*?([\"\']??)([^\" >]*?)\\1[^>]*>(.*)<\/a>/siU";
        while (preg_match($regexp, $data, $matches)) {
            //Revert the sprintf escaping
            $url = str_replace('%%', '%', $matches[2]);
            $text = str_replace('%%', '%', $matches[3]);
            //Check for an valid url
            if ($url) {
                $urlScheme = strtolower(parse_url($url, PHP_URL_SCHEME));
                if ($urlScheme !== 'http' && $urlScheme !== 'https') {
                    $url = null;
            //Use hash tag as fallback
            if (!$url) {
                $url = '#';
            //Recreate a minimalistic secure a tag
            $links[] = sprintf(
                '<a href="%s">%s</a>',
                htmlspecialchars($url, ENT_QUOTES, 'UTF-8', false),
            $data = str_replace($matches[0], '%' . $i . '$s', $data);
        $data = parent::escapeHtml($data, $allowedTags);
        return vsprintf($data, $links);
    return parent::escapeHtml($data, $allowedTags);

However, when trying to view an order, I'm getting a fatal error because the parent class does not have an escapeHtml() function. Here's the error:

Call to undefined method Mage_Core_Helper_Abstract::escapeHtml()

It seems the htmlEscape() may be what we need, but I haven't tried it yet.


1 Answer 1


It does seem that changing all instances of parent::escapeHtml in the file to parent::htmlEscape gets this working.

  • 4
    Yep, somewhere in Magento 1.4.x.x, escapeHtml was deprecated and renamed to htmlEscape(). When they backported SUPEE-7405, the developers forgot that fact and what works for comes up numpty when applied to Jan 23, 2016 at 2:21
  • @FiascoLabs this is indeed the correct answer.
    – philwinkle
    Jan 24, 2016 at 1:20
  • Thank you! Patched that manually. Supee 7405 is the worst Magento Patch ever... Just broke 5.3 compatibility and now this issue... Lets see whats next :) Feb 1, 2016 at 9:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.