fix XSS on comment