This is my way i do comments (I think its secure):
<h1>Comment's:</h1>
<?php
$i = addslashes($_POST['a']);
$ip = addslashes($_POST['b']);
$a = addslashes($_POST['c']);
$b = addslashes($_POST['d']);
if(isset($i) & isset($ip) & isset($a) & isset($b))
{
$r = mysql_query("SELECT COUNT(*) FROM $db.ban WHERE ip=$ip"); //Check if banned
$r = mysql_fetch_array($r);
if(!$r[0]) //Phew, not banned
{
if(mysql_query("INSERT INTO $db.com VALUES ($a, $b, $ip, $i)"))
{
?>
<script type="text/javascript">
window.location="/index.php?id=".<?php echo $i; ?>;
</script>
<?php
}
else echo "Error, in mysql query";
}
else echo "Error, You are banned.";
}
$x = mysql_query("SELECT * FROM $db.com WHERE i=$i");
while($r = mysql_fetch_object($x) echo '<div class="c">'.$r->a.'<p>'.$row->b.'</p> </div>';
?>
<h1>Leave a comment, pl0x:</h1>
<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
<input type="hidden" name="a" value="<?php $echo $_GET['id']; ?>" />
<input type="hidden" name="b" value="<?php $echo $_SERVER['REMOTE_ADDR']; ?>" />
<input type="text" name="c" value="Name"/></br>
<textarea name="d">
</textarea>
<input type="submit" />
</form>
This does it all in one page (This is only the comments section, some configuration is needed)