XSS vulnerability in comments: user was able to post links with 'javascript:code' links...