Just use:
$_SESSION['comments'] = zen_output_string_protected($_POST['comments']);

... and BE SURE to plan for an upgrade in the next couple months. Seriously.



(Edit: I see in another forum thread you've said you're working on your upgrade. Kudos.)