Posting something like `<script type="text/javascript">alert('hello')</script>` creates a blank comment instead of safely HTML encoding the text.