security fix XSS-atack in comment