Hacker News Reader

Sorry, would you mind explaining what this will do?

Improper input sanitation, you can potentially add raw html to other people's pages (XSS).

Doesn't the regex sanitize it before display?

Yes but it's pretty easily bypassed

How is it easily bypassed?

I asked earlier because I'm genuinely curious, but do you have a payload that would bypass this particular regex?