diff --git a/assets/js/ticket.js b/assets/js/ticket.js
index 4323afa..7d78f64 100644
--- a/assets/js/ticket.js
+++ b/assets/js/ticket.js
@@ -1232,6 +1232,7 @@ document.addEventListener('DOMContentLoaded', function() {
         if (!target) return;
 
         const action = target.dataset.action;
+        console.log('Action clicked:', action, 'Target:', target);
         switch (action) {
             case 'remove-dependency':
                 removeDependency(target.dataset.dependencyId);
@@ -1457,10 +1458,13 @@ function deleteComment(commentId) {
  * Show reply form for a comment
  */
 function showReplyForm(commentId, userName) {
+    console.log('showReplyForm called:', commentId, userName);
+
     // Remove any existing reply forms
     document.querySelectorAll('.reply-form-container').forEach(form => form.remove());
 
     const commentDiv = document.querySelector(`.comment[data-comment-id="${commentId}"]`);
+    console.log('commentDiv found:', commentDiv);
     if (!commentDiv) return;
 
     const replyFormHtml = `
diff --git a/views/TicketView.php b/views/TicketView.php
index 15b7008..1fdb3ff 100644
--- a/views/TicketView.php
+++ b/views/TicketView.php
@@ -362,7 +362,7 @@ $nonce = SecurityHeadersMiddleware::getNonce();
                                         echo "<div class='comment-actions'>";
                                         // Reply button (max depth of 3)
                                         if ($threadDepth < 3) {
-                                            echo "<button type='button' class='comment-action-btn reply-btn' data-action='reply-comment' data-comment-id='{$commentId}' data-user='" . htmlspecialchars($displayName) . "' title='Reply'>↩</button>";
+                                            echo "<button type='button' class='comment-action-btn reply-btn' data-action='reply-comment' data-comment-id='{$commentId}' data-user=\"" . htmlspecialchars($displayName, ENT_QUOTES) . "\" title='Reply'>↩</button>";
                                         }
                                         // Edit/Delete buttons for owner or admin
                                         if ($canModify) {