Security patch - HTML in comments