Fix javascript

you need to validate what the javascript sends to the php, or else you will get hacked 
this is the same as document.theform.comments.onchange =  validateComments