The thing here is that if something goes wrong and malicious code ends up in the db, I have to go through every comment and clean them vs. just changing the cod

The thing here is that if something goes wrong and malicious code ends up in the db, I have to go through every comment and clean them vs. just changing the code which cleans them way out.