disable_html_in_comments.php

<?php
// This will occur when the comment is posted
function theme-slug_comment_post( $incoming_comment ) {
    // convert everything in a comment to display literally
    $incoming_comment['comment_content'] = htmlspecialchars($incoming_comment['comment_content']);
    // the one exception is single quotes, which cannot be #039; because WordPress marks it as spam
    $incoming_comment['comment_content'] = str_replace( "'", '&apos;', $incoming_comment['comment_content'] );
    return( $incoming_comment );
}
// This will occur before a comment is displayed
function theme-slug_comment_display( $comment_to_display ) {
    // Put the single quotes back in
    $comment_to_display = str_replace( '&apos;', "'", $comment_to_display );
    return $comment_to_display;
}
add_filter( 'preprocess_comment', 'theme-slug_comment_post', '', 1 );
add_filter( 'comment_text', 'theme-slug_comment_display', '', 1 );
add_filter( 'comment_text_rss', 'theme-slug_comment_display', '', 1 );
add_filter( 'comment_excerpt', 'theme-slug_comment_display', '', 1 );
// This stops WordPress from trying to automatically make hyperlinks on text:
remove_filter( 'comment_text', 'make_clickable', 9 );