I am struggling with the problem of displaying a personalized field (first name) in email. The problem is that sometimes can happened situation when person, which is registering to the company's system, instead of, for example, write "Alicja" into First Name field, will put "<img src="htt ps://shorturlxx.at/xxxxx“>" OR some worst problematic different code which can be executed. The problem is - after registration part, email is sent. Email contains personalization, like: Hello %%FirstName%%. This means, if user will put some dangerous code into First Name field, code will places in the email, like Welcome <img src="htt ps://shorturlxx.at/xxxxx“>. In provided example nothing wrong will happend, Simple email will have "Welcome" and image will appear next to it. But can happened that someone will put email address somebody's, then in First Name put dangerous code, which will execute when person will receive an email.

Question: : is there any function in Marketing Cloud which will prevent to execute code if someone will provide it? Amp Script and SSJS would not execute if we are using AttributeValue, but "src=...url" was not displayed as a string, but as an image. I was testing it, looking for functions. Have no idea for the solution. Regex/string validation is not the available option. Case is to show whole string as registered person provided- which can be possible code, as a none executing string.


2 Answers 2


Lukas's approach is the best way to go. But since you can not use regex for some reason, the only thing I can suggest is escaping HTML so it is not rendered, you can use this approach by replacing <, > and & characters.

Let's say the first name is stored in a DE, use the code below to show the field's value without rendering it:

set @FirstNameCleared = Replace(firstname, '&', '&amp;')
set @FirstNameCleared = Replace(@FirstNameCleared, '<', '&lt;')
set @FirstNameCleared = Replace(@FirstNameCleared, '>', '&gt;')

  • 1
    I think you understood the question better than I did - simple and elegant. Upvote from me :-) Commented Dec 1, 2022 at 16:16
  • Hi ! thats worked for the URLs! <thanks!!>, but I have a question, this is working for the URLs, will it works as well for example for some JQuery functions / Java script. or other unknown for me scripts which somebody can put to make something bad for the owner of email? Its hard to me to create such a case as I am not really scripting dangerous codes .. But maybe simple I will try to find most common "begins" of codes in different languages and represents them as 'Text HTML' which you showed me :) ?
    – aliwy
    Commented Dec 5, 2022 at 8:36
  • 1
    I mean I'm not a security expert, but I assume it will at least partially work for Javascript and JQuery as both need <script> tags to work. You can test it easily by placing Javascript and HTML in a data extension. Don't forget to upvote and accept the answer if it really helped, it will help others by giving it more visibility. Commented Dec 5, 2022 at 13:19
  • @Alicjasfmc The vast majority of email clients block scripts (e.g. JavaScript) since they can hide malicious content. So even if you include <script> in the HTML of the email, it will not be executed in the email client (even in case this is a browser based client, like Gmail) Commented Dec 8, 2022 at 8:07
  • @LukasLunow It will be interpreted. I mean I am not sure about the <script> but for example simple URL will be visible. link can be shown in email and email can have malicious content unfortunately. That is why there is need to prevent executing everything. So simply interpreted it only as a text. But its not that easy because there can be lots of different scripts which will work event if we replace &, < or >. So the solution is very helpful, for <script> and urls. But actually still looking for some , lets say, general functionality
    – aliwy
    Commented Dec 8, 2022 at 8:45

Doing this in data sanitization in emails is not something you should do. This emphasizes and underlying issue with the lack of validation of data input on your signup forms, which is where you should put your effort. Of course this will not fix the data quality retroactively, so you should use this approach for clearing your data:

set @string = AttributeValue('FirstName')
for @i = 1 to length(@string) do
  set @char = substring(@string,@i,1)
  set @result = iif(empty(regexmatch(@char,'[a-zA-Z0-9]',0)),concat(@result,''),concat(@result,@char)) 
next @i

Above script will remove all but alphanumerical characters from your FirstName field, and display it in the @result variable.

You can adjust the content of regexmatch function if you want to change the criteria for cleaning your input. Do observe, that this regex will not remove tags, just the special characters.

  • Hi Thank you very much for your hint! :) I know that my proposed solution is not really let say professional but I cannot change any part of the string (first name needs to remain exactly same as user provided), So that is why regex / subsstring are not the solution for me and I am looking for some function / set of actions to help me make the string non executable.
    – aliwy
    Commented Dec 1, 2022 at 13:11
  • @Alicjasfmc What do you mean by non-executable? Please explain. Commented Dec 1, 2022 at 13:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .