Fix #75 comment xss