Author name in comment preview not rendering apostrophe properly: a bug or by-design? This happens on a Drupal 7.26 using the default theme when previewing a comment. The &amp;#039 part is equivalent to an apostrophe. What I don't know if this is something that is part of Drupal to prevent exploits or if this is a bug that should be fixed. I tried searching the Drupal.org forums if this is a bug, I wasn't able to find anything relevant.
Interesting problem to solve ... Here are the findings of above problem.. I do see this issue in latest Drupal..  I believe it's a bug since check_plain method is not used in any other comment rendering features where as we can see proper name while viewing comment...

Comment preview is rendered from comment_preview function defined in 2062 Line in comment module..

/**
 * Generate a comment preview.
 */
function comment_preview($comment) {
  global $user;

  drupal_set_title(t('Preview comment'), PASS_THROUGH);

  $node = node_load($comment-&gt;nid);

  if (!form_get_errors()) {
    $comment_body = field_get_items('comment', $comment, 'comment_body');
    $comment-&gt;format = $comment_body[0]['format'];
    // Attach the user and time information.
    if (!empty($comment-&gt;name)) {
      $account = user_load_by_name($comment-&gt;name);
    }
    elseif ($user-&gt;uid &amp;&amp; empty($comment-&gt;is_anonymous)) {
      $account = $user;
    }

    if (!empty($account-&gt;uid)) {
      $comment-&gt;uid = $account-&gt;uid;
      $comment-&gt;name = check_plain($account-&gt;name);
      $comment-&gt;signature = $account-&gt;signature;
      $comment-&gt;signature_format = $account-&gt;signature_format;
      $comment-&gt;picture = $account-&gt;picture;
    }
    elseif (empty($comment-&gt;name)) {
      $comment-&gt;name = variable_get('anonymous', t('Anonymous'));
    }

    $comment-&gt;created = !empty($comment-&gt;created) ? $comment-&gt;created : REQUEST_TIME;
    $comment-&gt;changed = REQUEST_TIME;
    $comment-&gt;in_preview = TRUE;
    $comment_build = comment_view($comment, $node);
    $comment_build['#weight'] = -100;

    $form['comment_preview'] = $comment_build;
  }

  if ($comment-&gt;pid) {
    $build = array();
    if ($comments = comment_load_multiple(array($comment-&gt;pid), array('status' =&gt; COMMENT_PUBLISHED))) {
      $parent_comment = $comments[$comment-&gt;pid];
      $build = comment_view($parent_comment, $node);
    }
  }
  else {
    $build = node_view($node);
  }

  $form['comment_output_below'] = $build;
  $form['comment_output_below']['#weight'] = 100;

  return $form;
}


As you can see 

$comment-&gt;name = check_plain($account-&gt;name);


Comment name is rendered using above statement which takes $account->name as input and wraps using check_plain function which "Encodes special characters in a plain-text string for display as HTML."

Coming to the solution..


Comment Preview is rendered using Comment_view Function which gives us hook "hook_comment_view"
By Implementing above hook in your custom module you can check for $account->name and use htmlspecialchars_decode to decode back to original value...