Fix: Prevent cross-site scripting in comments

Any time we use the jQuery.html() call, we need
to escape the input so people don't hack the site.