The function below wraps user comments in a <div> with no escaping at all.
The bug: a comment containing <script>alert(document.cookie)</script> gets rendered as *actual HTML* — the attacker's JavaScript runs in every visitor's browser, with access to their session cookie.
Your task: fix solve(comments) so every comment is HTML-escaped before being wrapped, using Python's built-in html module.
solve(['hello']) → ['<div>hello</div>']solve(['<script>alert(1)</script>']) → ['<div><script>alert(1)</script></div>']
Sample tests