diff --git a/chant.php b/chant.php
index 2d96b84..bad400e 100644
--- a/chant.php
+++ b/chant.php
@@ -246,7 +246,7 @@ if($req1->num_rows > 0 || $c['transcriber'] > '') {
 }
 while ($m = $req1->fetch_assoc()) {
 	$user_info = get_userdata($m['user_id']);
-	echo "<li>".date("M d, Y",$m['time']).": ".$m['comment']." (".$user_info->display_name.') <a href="history.php?changeset='.$m['time'].'|'.$id.'|'.$m['user_id']."\">?</a></li>\n";
+	echo "<li>".date("M d, Y",$m['time']).": ".htmlspecialchars($m['comment'])." (".$user_info->display_name.') <a href="history.php?changeset='.$m['time'].'|'.$id.'|'.$m['user_id']."\">?</a></li>\n";
 }
 if($c['transcriber'] > '') {
 	echo "<li>Original transcriber: ".$c['transcriber']."</li>\n";
diff --git a/feed.php b/feed.php
index 854a9d5..1e585fe 100644
--- a/feed.php
+++ b/feed.php
@@ -28,7 +28,7 @@ $user_info = get_userdata($m['user_id']);
 echo '<entry>
 	<title type="html">'.chant_from_id($m['chant_id'])[1].'</title>
 	<link href="'.$dir.'chant.php?id='.$m['chant_id'].'" />
-	<summary>'.$m['comment'].'</summary>
+	<summary>'.htmlspecialchars($m['comment']).'</summary>
 	<updated>'.date(DATE_ATOM,$m['time']).'</updated>
 	<author>
 		<name>'.$user_info->display_name.'</name>
@@ -43,7 +43,7 @@ while($m = $req1->fetch_assoc()) {
 	echo '<entry>
 	<title type="html">'.chant_from_id($m['chant_id'])[1].'</title>
 	<link href="'.$dir.'chant.php?id='.$m['chant_id'].'" />
-	<summary>'.$m['comment'].'</summary>
+	<summary>'.htmlspecialchars($m['comment']).'</summary>
 	<updated>'.date(DATE_ATOM,$m['time']).'</updated>
 	<author>
 		<name>'.$user_info->display_name.'</name>
diff --git a/scores.php b/scores.php
index f079683..faef4d4 100644
--- a/scores.php
+++ b/scores.php
@@ -69,7 +69,7 @@ foreach($mod as $d => $ml) {
 	echo "<ul>\n";
 	foreach($ml as $m) {
 		echo '<li><a href="chant.php?id='.$m['chant_id'].'">'.format_incipit(chant_from_id($m['chant_id'])[1])."</a><br />\n";
-		echo "<i>".$m['comment']."</i></li>\n";
+		echo "<i>".htmlspecialchars($m['comment'])."</i></li>\n";
 	}
 	echo "</ul><br />\n";
 }
diff --git a/updates.php b/updates.php
index 3168d04..50bdb22 100644
--- a/updates.php
+++ b/updates.php
@@ -24,7 +24,7 @@ foreach($mod as $d => $ml) {
 	foreach($ml as $m) {
 		$user_info = get_userdata($m['user_id']);
 		echo "<li>".' <a href="chant.php?id='.$m['chant_id'].'">'.format_incipit(chant_from_id($m['chant_id'])[1])."</a><br />\n";
-		echo "<i>".$m['comment'].'</i> <span class="version">('.$user_info->display_name.")</span></li>\n";
+		echo "<i>".htmlspecialchars($m['comment']).'</i> <span class="version">('.$user_info->display_name.")</span></li>\n";
 	}
 	echo "</ul>\n";
 }