Updated app.py

app.py

@@ -425,7 +425,8 @@ else:
         st.session_state.comments = []
 
     def add_comment(comment):
-        st.session_state.comments.append({"name": "", "comment": comment, "date": datetime.now().strftime("%d, %b %Y")})
+        sanitized_comment = html.escape(comment)
+        st.session_state.comments.append({"name": "", "comment": sanitized_comment, "date": datetime.now().strftime("%d, %b %Y")})
 
     if 'name' not in st.session_state:
         st.session_state.name = ""