The `raw` here makes this vulnerable to XSS attacks (try reporting a post/comment with `<script>alert(0);</script>`.