diff --git a/app/Models/HitAndRun.php b/app/Models/HitAndRun.php
index dbd0bebc..d2eea2fa 100644
--- a/app/Models/HitAndRun.php
+++ b/app/Models/HitAndRun.php
@@ -57,7 +57,8 @@ class HitAndRun extends NexusModel
 
     public static function getIsEnabled(): bool
     {
-        return Setting::get('hr.mode') != self::MODE_DISABLED;
+        $result = Setting::get('hr.mode');
+        return $result && in_array($result, [self::MODE_GLOBAL, self::MODE_MANUAL]);
     }
 
     public function torrent(): \Illuminate\Database\Eloquent\Relations\BelongsTo
diff --git a/app/Repositories/BonusRepository.php b/app/Repositories/BonusRepository.php
index dfd3f748..3729059a 100644
--- a/app/Repositories/BonusRepository.php
+++ b/app/Repositories/BonusRepository.php
@@ -13,8 +13,7 @@ class BonusRepository extends BaseRepository
 {
     public function consumeToCancelHitAndRun($uid, $hitAndRunId)
     {
-        $hitAndRunMode = Setting::get('hr.mode');
-        if ($hitAndRunMode == HitAndRun::MODE_DISABLED) {
+        if (!HitAndRun::getIsEnabled()) {
             throw new \LogicException("H&R not enabled.");
         }
         $user = User::query()->findOrFail($uid);
@@ -44,6 +43,7 @@ class BonusRepository extends BaseRepository
                 'now' => Carbon::now()->toDateTimeString(),
                 'bonus' => $requireBonus,
             ], $user->locale);
+            $comment = addslashes($comment);
             do_log("comment: $comment");
             $hitAndRun->update([
                 'status' => HitAndRun::STATUS_PARDONED,