I just thought I'd let everyone know that I found a bug in the comments (and possibly questions as well). I went to post a comment in webmasters and I put < noscript > in it and instead of it just showing the tag, it parsed it as actual HTML. I am not sure if this can lead to XSS but I am not leaving that to doubt. Please fix this.
There's no HTML allowed in comments. This includes all tags and (sadly) character references.
Since you wrote
and you used the
and you inspected the HTML code in the developer tools (or whatever it's called in your browser).
Indeed, Chrome shows the following: