Fix more problems including double escaping in comments (only escaping
them for SQL when inserting them into the DB now, all uses of comments
should be htmlentities'd when output now).