I was wondering what happens when a customer is putting html or scripts in his profile attributes on Commerce Cloud and he orders something and we send out an order confirmation email with those attributes in the email. How can we avoid rendering that HTML/Script and just paste it as text?


You don't need to escape AmpScript in variables unless you explicitly ask the platform to render it by wrapping it in TreatAsContent. Example:

%%[ SET @Firstname = "%%=add(2,2)=%%" ]%%

We can reference it using:


Outputting: %%=add(2,2)=%%

Or We can reference it:


Outputting: 4

For HTML, you can use RegexMatch, which Adam Spriggs illustrates in his blog. Using <[^>]*> as your matching pattern, will find all the HTML tags, which you can then use Replace function to strip out.

However, for both AmpScript and HTML, I will recommend you to do validation on input, and not on output - as this will improve your data quality. Following the approach I have described is doable, but only fix the symptoms - not the core of the problem.

| improve this answer | |
  • And what about HTML? Because we currently have the issue where escaped HTML is passed through XML (e.g., <b>Lukas Lunow</b>) but when printing this name in the email it is in bold. – user3485470 Sep 11 '19 at 9:40
  • Updated my answer accordingly – Lukas Lunow Sep 11 '19 at 9:48
  • Feels like an impossible job though, as there is also SQL, SSJS, etc. Commerce Cloud escapes them by default, wish MC did the same. – user3485470 Sep 11 '19 at 10:01
  • This is why I suggest doing validation on the form, when profile attributes are created in Commerce Cloud. This will solve this across all these aspects you mention – Lukas Lunow Sep 11 '19 at 10:36
  • @user3485470 - please accept/upvote my answer if it has been helpful – Lukas Lunow Sep 27 '19 at 11:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.