--- C:/drupal-6.x-dev/modules/filter/filter.module	Sun Apr 15 11:36:10 2007
+++ C:/drupal-6.x-dev/modules/filter/Copy of filter.module	Tue Apr 24 10:21:21 2007
@@ -1264,7 +1264,9 @@
   // Store the input format
   _filter_xss_split($allowed_tags, TRUE);
   // Remove NUL characters (ignored by some browsers)
-  $string = str_replace(chr(0), '', $string);
+  $string = str_replace(chr(0), '', $string);
+  // Remove comments (and their potentially nasty contents)
+  $string = preg_replace('/<!--.*-->/sU', '', $string);
   // Remove Netscape 4 JS entities
   $string = preg_replace('%&\s*\{[^}]*(\}\s*;?|$)%', '', $string);