I was wondering what happens when a customer is putting html or scripts in his profile attributes on Commerce Cloud and he orders something and we send out an order confirmation email with those attributes in the email. How can we avoid rendering that HTML/Script and just paste it as text?
You don't need to escape AmpScript in variables unless you explicitly ask the platform to render it by wrapping it in TreatAsContent. Example:
%%[ SET @Firstname = "%%=add(2,2)=%%" ]%%
We can reference it using:
Or We can reference it:
For HTML, you can use RegexMatch, which Adam Spriggs illustrates in his blog. Using <[^>]*> as your matching pattern, will find all the HTML tags, which you can then use Replace function to strip out.
However, for both AmpScript and HTML, I will recommend you to do validation on input, and not on output - as this will improve your data quality. Following the approach I have described is doable, but only fix the symptoms - not the core of the problem.