Unless you are careful when constructing the HTML, hackers can abuse the comment function by injecting JavaScript.