diff --git a/src/engine/comment.js b/src/engine/comment.js
index 6dec2f0f4..34bbcabd5 100644
--- a/src/engine/comment.js
+++ b/src/engine/comment.js
@@ -5,6 +5,7 @@
 
 const uid = require('../util/uid');
 const Cast = require('../util/cast');
+const xmlEscape = require('../util/xml-escape');
 
 class Comment {
     /**
@@ -31,7 +32,7 @@ class Comment {
     toXML () {
         return `<comment id="${this.id}" x="${this.x}" y="${
             this.y}" w="${this.width}" h="${this.height}" pinned="${
-            this.blockId !== null}" minimized="${this.minimized}">${this.text}</comment>`;
+            this.blockId !== null}" minimized="${this.minimized}">${xmlEscape(this.text)}</comment>`;
     }
 
     // TODO choose min and defaults for width and height