Preventing XSS injection in querystring

You can try this code 

$comment = strip_tags($string);