Simple comment system This is a comment system that I wrote, is it secure?

&lt;!doctype html&gt;
&lt;html&gt;
&lt;head&gt;
&lt;meta charset="utf-8"&gt;
&lt;link rel="stylesheet" type="text/css" href="style.css"&gt;
&lt;?PHP 

//Turn off error reporting (Not Necessary)
    error_reporting(E_ALL ^ E_NOTICE);

//Connect to the database
    if (!@mysql_connect('localhost', 'user', '') or !@mysql_select_db('comments')) {
        die('Could not connect, please check back later.'); 
    }

//Variables
    $guest_name = htmlentities(str_replace(' ', '',$_POST['guest_name']));
    $comment = htmlentities($_POST['comment']);
    $time = date('g:i A', time());
    $date = date('n/j/Y');
    $query = "INSERT INTO `user_comments` VALUES(
        '".mysql_real_escape_string('')."',
        '".mysql_real_escape_string($guest_name)."',
        '".mysql_real_escape_string($comment)."',
        '".mysql_real_escape_string($date)."',
        '".mysql_real_escape_string($time)."'
        )";
    $array_query = mysql_query("SELECT * FROM `comments` ORDER BY `ID` DESC");

//Insert comment into the database
    if (isset($_POST['submit_comment']) &amp;&amp; !empty($comment) &amp;&amp; !empty($guest_name)) {
        if(mysql_query($query)) {
            header('Location: index.php');  
        }
    } 

//Check if user has filled in all fields    
    if (isset($_POST['submit_comment']) &amp;&amp; empty($guest_name)) {
        echo '&lt;span style="color:red"&gt;*Please enter a Guest Name*&lt;/span&gt;&lt;br&gt;';  
    } 

    if (isset($_POST['submit_comment']) &amp;&amp; empty($comment)) {
        echo '&lt;span style="color:red"&gt;*Please enter a Comment*&lt;/span&gt;'; 
    } 

//List comments
    function list_comments () {
        $query = "SELECT * FROM `user_comments` ORDER BY `ID` DESC";
        $query_run = mysql_query($query);
        while ($result = mysql_fetch_array($query_run)) {
            echo '&lt;div id="comment_border"&gt;' . $result['Guest Name'] . ' - ' . $result['Date'] . ' - ' . $result['Time'] . '&lt;br&gt;' . $result['Comment'] . '&lt;br&gt;&lt;/div&gt;&lt;br&gt;';  
        }
    };

?&gt;
&lt;title&gt;Main_Page&lt;/title&gt;
&lt;/head&gt;

&lt;body&gt;
&lt;!-- \/ COMMENT FORM \/ --&gt;
&lt;form method="post" action="index.php"&gt;

    &lt;input type="text" name="guest_name" maxlength="15" placeholder="Guest Name"&gt;&lt;br&gt;
    &lt;textarea cols="70" rows="5" name="comment" maxlength="512" placeholder="Comment"&gt;&lt;/textarea&gt;
    &lt;input type="submit" name="submit_comment"&gt;

&lt;/form&gt;
&lt;!-- /\ COMMENT FORM /\ --&gt;
&lt;hr&gt;&lt;h1&gt;Comments&lt;/h1&gt;&lt;br&gt;
&lt;!-- Comments will list below here --&gt;
&lt;?PHP

    list_comments();

?&gt;
&lt;/body&gt;
&lt;/html&gt;
&lt;?PHP


Normally it's all lower case, just saying.



//Turn off error reporting (Not Necessary)
error_reporting(E_ALL ^ E_NOTICE);


This is one prime example of confusing and not helpful commenting. If this call is not necessary, why is it there at all?



if (!@mysql_connect('localhost', 'user', '') or !@mysql_select_db('comments')) {


Stop using the mysql_* functions, seriously.



$guest_name = htmlentities(str_replace(' ', '',$_POST['guest_name']));


Why are you replacing entities here? You should not replace stuff when saving it into your database. Ideally the data in your database would be as unbiased as possible. Only replace entities if you need to, f.e. you display it on a webpage.



$time = date('g:i A', time());
$date = date('n/j/Y');
$query = "INSERT INTO `user_comments` VALUES(
    '".mysql_real_escape_string('')."',
    '".mysql_real_escape_string($guest_name)."',
    '".mysql_real_escape_string($comment)."',
    '".mysql_real_escape_string($date)."',
    '".mysql_real_escape_string($time)."'
    )";


From this query I can tell you a few things:


Your database layout is sub-optimal, it uses VARCHAR fields if it should use a DATETIME field.
You like to copy and paste code, that's bad.
You don't do things explicitly, consider adding a fields list to your queries.


First, you should be using a DATETIME type if you're gonna save date and time. MySQL supports also a 'pure' DATE and TIME format, there's absolutely no reason and no excuse to use use a VARCHAR field for that.

And then there's your missing fields list, I made a habit out of adding a fields list to my queries for two reasons:


It let's the reader know exactly what is getting set to where.
It makes your code more robust, the query will not fail if you add a field. Removing a field is also easier, as a simple grep for the field will yield all queries that use it.


So, your query should look like this:

$query = "
    INSERT INTO 
        user_comments
    SET
        name = :name,
        comment = :comment;
";


It's easy to read and you know exactly what ends where. Additionally the date/time stuff is here completely missing, because I changed the database layout:

CREATE TABLE user_comments
    name VARCHAR,
    comment VARCHAR,
    timestamp TIMESTAMP DEFAULT CURRENT_TIMESTAMP;


The TIMESTAMP type is optimal for this kind of operation, as it is able to save automatically the time when the row is created.



$array_query = mysql_query("SELECT * FROM `comments` ORDER BY `ID` DESC");


Same here, your usage of the * makes it easily broken by adding new fields. Additionally you don't know what fields are fetched until you look at the table declaration.



header('Location: index.php');


I'm 99% sure that this should not work. Headers can not be changed after data was send, you set the header in the middle of the file, but your php script should be moved to the top of the file. Additionally if you want to redirect people, it would be good to die() afterwards to make sure that your script stops executing at this point:

&lt;?php
    if (condition) {
        header("Location: othersite.php");
        die("Redirect: &lt;full address here&gt;");
    }
?&gt;
&lt;html&gt;
    &lt;head&gt;
    ...


This will also allow everyone who is not automatically redirected to see where to go to now.



echo '&lt;span style="color:red"&gt;*Please enter a Guest Name*&lt;/span&gt;&lt;br&gt;';


You're outputting stuff while inside the &lt;head&gt;, that's bad practice, content should go into the &lt;body&gt;.



&lt;!-- \/ COMMENT FORM \/ --&gt;


What is this?!



And just to make sure:

Stop using the mysql_* functions and start using prepared queries!