add anti-XSS function to comment-text