retrieve user name not only from contacts (comments can be given from users not in contacts)
security: protection against sql injections