Fix XSS in comments