Operations with DB changed. Sub query deleted and sorting by Primary key id added. Added MySQL variables :username, :message, :date for prevent SQL injections.
Html encode for tags added.