html comment tag fix
xss filter on user input