An XSS (cross-site scripting) vulnerability allows JavaScript code to be injected into a page displayed to other users. It is avoided by escaping any data displayed in HTML, in PHP with htmlspecialchars, which converts <, >, & and quotes into entities.
Example
echo htmlspecialchars($commentaire, ENT_QUOTES, 'UTF-8');