Help test my new website!

Quick notes for @Mahen — and good point, @Member#46692 about bots. To isolate the display bug reproduce it with controlled inputs: very long usernames, names containing angle brackets, and comments with no spaces. Open the browser DevTools, inspect the rendered DOM and the raw HTML the server sends, and look for unclosed or mis-nested tags or for places where user content is injected as HTML instead of text.

Common causes and quick fixes: the app is likely writing user strings into the page as HTML (innerHTML) or not enforcing length limits. Always escape on output and enforce length limits server-side (client-side maxlength is only UX). In templates or server code use your language/framework escaping routine; in the browser prefer setting text content instead of HTML, for example element.textContent = username. For PHP output, use a safe escape:

echo htmlspecialchars($username, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');

A small CSS safeguard that prevents layout breakage from long, unbroken strings:

.comment-body {
  max-width: 700px;
  overflow-wrap: anywhere;
  word-wrap: break-word;
  white-space: normal;
}

Also separate username/meta into their own element (or use a flex container) so the name cannot collapse into the comment block when layout shifts.

For spam/bots use layered defenses: a hidden honeypot field, server-side rate limiting, content throttling, and only add CAPTCHA where needed. For XSS prevention and output-escaping patterns see the OWASP XSS Prevention Cheat Sheet. For the CSS properties above see MDN: overflow-wrap. Consider an external anti-bot option if automated posting becomes persistent, for example Google reCAPTCHA.