update: - User comment servlet
            1. Changed statement to preparedStatement to prevent user 
               to get in suc_comment.jsp directly