Using HTML-style comments in a page that will be generated or interpolated server-side before being served to the user increases the risk of
exposing data that should be kept private. For instance, a developer comment or line of debugging information that’s left in a page could easily (and
has) inadvertently expose:
- Version numbers and host names
- Full, server-side path names
- Sensitive user data
Every other language has its own native comment format, thus there is no justification for using HTML-style comments in anything other than a pure
HTML or XML file.
