diff --git a/core/modules/comment/comment.tokens.inc b/core/modules/comment/comment.tokens.inc
index 500533e..1bd179e 100644
--- a/core/modules/comment/comment.tokens.inc
+++ b/core/modules/comment/comment.tokens.inc
@@ -154,7 +154,7 @@ function comment_tokens($type, $tokens, array $data, array $options, BubbleableM
           break;
 
         case 'title':
-          $replacements[$original] = $sanitize ? Xss::filter($comment->getSubject()) : $comment->getSubject();
+          $replacements[$original] = $sanitize ? Html::escape($comment->getSubject()) : $comment->getSubject();
           break;
 
         case 'body':
@@ -183,14 +183,14 @@ function comment_tokens($type, $tokens, array $data, array $options, BubbleableM
           if ($comment->getOwnerId()) {
             $bubbleable_metadata->addCacheableDependency($comment->getOwner());
           }
-          $replacements[$original] = $sanitize ? Xss::filter($name) : $name;
+          $replacements[$original] = $sanitize ? Html::escape($name) : $name;
           break;
 
         case 'parent':
           if ($comment->hasParentComment()) {
             $parent = $comment->getParentComment();
             $bubbleable_metadata->addCacheableDependency($parent);
-            $replacements[$original] = $sanitize ? Xss::filter($parent->getSubject()) : $parent->getSubject();
+            $replacements[$original] = $sanitize ? Html::escape($parent->getSubject()) : $parent->getSubject();
           }
           break;
 
@@ -210,7 +210,7 @@ function comment_tokens($type, $tokens, array $data, array $options, BubbleableM
           $entity = $comment->getCommentedEntity();
           $bubbleable_metadata->addCacheableDependency($entity);
           $title = $entity->label();
-          $replacements[$original] = $sanitize ? Xss::filter($title) : $title;
+          $replacements[$original] = $sanitize ? Html::escape($title) : $title;
           break;
       }
     }
diff --git a/core/modules/comment/src/Tests/CommentTokenReplaceTest.php b/core/modules/comment/src/Tests/CommentTokenReplaceTest.php
index 0bc6be6..cf96998 100644
--- a/core/modules/comment/src/Tests/CommentTokenReplaceTest.php
+++ b/core/modules/comment/src/Tests/CommentTokenReplaceTest.php
@@ -54,10 +54,10 @@ function testCommentTokenReplacement() {
     $tests = array();
     $tests['[comment:cid]'] = $comment->id();
     $tests['[comment:hostname]'] = Html::escape($comment->getHostname());
-    $tests['[comment:author]'] = Xss::filter($comment->getAuthorName());
+    $tests['[comment:author]'] = Html::escape($comment->getAuthorName());
     $tests['[comment:mail]'] = Html::escape($this->adminUser->getEmail());
     $tests['[comment:homepage]'] = UrlHelper::filterBadProtocol($comment->getHomepage());
-    $tests['[comment:title]'] = Xss::filter($comment->getSubject());
+    $tests['[comment:title]'] = Html::escape($comment->getSubject());
     $tests['[comment:body]'] = $comment->comment_body->processed;
     $tests['[comment:langcode]'] = Html::escape($comment->language()->getId());
     $tests['[comment:url]'] = $comment->url('canonical', $url_options + array('fragment' => 'comment-' . $comment->id()));
@@ -140,7 +140,7 @@ function testCommentTokenReplacement() {
     $comment->setOwnerId(0)->setAuthorName($author_name);
     $input = '[comment:author]';
     $output = $token_service->replace($input, array('comment' => $comment), array('langcode' => $language_interface->getId()));
-    $this->assertEqual($output, Xss::filter($author_name), format_string('Sanitized comment author token %token replaced.', array('%token' => $input)));
+    $this->assertEqual($output, Html::escape($author_name), format_string('Sanitized comment author token %token replaced.', array('%token' => $input)));
     $output = $token_service->replace($input, array('comment' => $comment), array('langcode' => $language_interface->getId(), 'sanitize' => FALSE));
     $this->assertEqual($output, $author_name, format_string('Unsanitized comment author token %token replaced.', array('%token' => $input)));