Allow PHP execution in the name pattern

I have two text fields (first name and last name). I need the realname to be first name + last initial: John D. or Adam S. for example.

The following bit of PHP would work nicely, if only the "name pattern" allowed for input filters so that I could select the PHP filter.

  $first = '%1';
  $last = '%2';
  return $first .' '. $last[0] .'.';

The attached patch does just that!

First, it patches realname.admin.inc to collect and save the input format information. Pretty straight-forward. Nothing dangerous here.

Second, it patches realname.module to do the following:

1. Escape all raw user input (the stuff that goes into $stuff) using htmlentities(<raw user input>, ENT_QUOTES).
   • This protects against dangerous attacks. For example, in the above PHP code, someone could do a lot of damage by doing something like Jo'; drupal_set_message('PHP Injection'); $dummy='hn as their first name. It would be interpreted as:

       $first = 'Jo'; drupal_set_message('PHP Injection'); $dummy='hn';
       $last = 'Doe';
       return $first .' '. $last[0] .'.';
     

   • In my tests, escaping the variables prevents any unwanted PHP injection:
     

       $first = 'Jo'; drupal_set_message('PHP Injection'); $dummy='hn';
       $last = 'Doe';
       return $first .' '. $last[0] .'.';
     

2. After the replacement tags in $pattern are replaced with the now-escaped stuff from $stuff, run the desired input filter using check_markup.
3. Now that the danger of a PHP injection attack is passed, un-escape the text using html_entity_decode(<escaped text>, ENT_QUOTES).
   • The username is still supposed to be plain text at this stage. There will be a check_plain() in this text's future, and if it's not un-escaped now, there will be problems with apostrophes and other special characters later. Our Irish friends would be most displeased to find their names turned into O'Reilly and O'Connor. Un-escape the username now, and the Irish will be very happy.

And finally, I believe this will also solve the occasionally continuing follow-up problems experienced in:
#338871: Display problems with name containing apostrophe
#616134: Special Characters
#666528: Display problems with name containing apostrophe