Stored XSS in Comments

1app.post('/api/comments', async (req, res) => {
2    const { postId, content } = req.body;
3    await db.comments.insert({ postId, content, userId: req.user.id });
4    res.json({ success: true });
5});
6
7app.get('/post/:id', async (req, res) => {
8    const post = await db.posts.findById(req.params.id);
9    const comments = await db.comments.find({ postId: req.params.id });
10    
11    let html = `<h1>${post.title}</h1>`;
12    comments.forEach(c => {
13        html += `<div class="comment">${c.content}</div>`;
14    });
15    res.send(html);
16});