Run p::clean() on any variables that contain data entered by users.

modules/comment/views/comment.html.php

@@ -4,14 +4,14 @@
     <a href="#">
       <img src="<?= $comment->author()->avatar_url(40, $theme->url("images/avatar.jpg", true)) ?>"
            class="gAvatar"
-           alt="<?= $comment->author_name() ?>"
+           alt="<?= p::clean($comment->author_name()) ?>"
            width="40"
            height="40" />
     </a>
     <?= t("on ") . date("Y-M-d H:i:s", $comment->created) ?>
-    <a href="#"><?= $comment->author_name() ?></a> <?= t("said") ?>
+    <a href="#"><?= p::clean($comment->author_name()) ?></a> <?= t("said") ?>
   </p>
   <div>
-    <?= $comment->text ?>
+    <?= p::clean($comment->text) ?>
   </div>
 </li>