fix xss bug in comments