diff --git a/cgi-bin/form.py b/cgi-bin/form.py
index 308e9f0..f0f865f 100755
--- a/cgi-bin/form.py
+++ b/cgi-bin/form.py
@@ -7,6 +7,7 @@ import collections
 from collections.abc import Mapping
 import hmac
 import mimetypes
+import re
 import os
 import secrets
 from typing import Any, Optional, overload
@@ -71,7 +72,7 @@ match os.environ.get("REQUEST_METHOD", "").upper():
 				# place the token *inside* the form. It assumes that there is
 				# a) only one form on the site and
 				# b) the <form> tag doesn't end on the same line.
-				if "<!-- FORM -->" in line.lower():
+				if re.match(r"<!--\s*form\s*-->", line, re.IGNORECASE) is not None:
 					print(f'<input type="hidden" name="csrftoken" value="{csrf_token}" />')
 
 					print(f'<label class="form-input">')