public function CommentStore($data, $form)
    {
        /**
         * If the "Extra" field is filled, we have a bot.
         * Also, the nsas (<noscript> Anti Spam) is a bot. Bot's don't use javascript.
         * Note, a legitimate visitor that has JS disabled, will be unable to post!
         */
        if (!isset($data['Extra']) || $data['Extra'] == '' || isset($data['nsas'])) {
            $data['Comment'] = Convert::raw2sql($data['Comment']);
            $exists = Comment::get()
                ->filter(array('Comment:PartialMatch' => $data['Comment']))
                ->where('ABS(TIMEDIFF(NOW(), Created)) < 60');
            if (!$exists->count()) {
                $comment = Comment::create();
                $form->saveInto($comment);
                $comment->NewsID = $data['NewsID'];
                $comment->write();
            }
        }
        Controller::curr()->redirectBack();
    }
public function CommentStore($data, $form)
    {
        /**
         * If the "Extra" field is filled, we have a bot.
         * Also, the nsas (<noscript> Anti Spam) is a bot. Bot's don't use javascript.
         * Note, a legitimate visitor that has JS disabled, will be unable to post!
         */
        if (!isset($data['Extra']) || $data['Extra'] == '' || isset($data['nsas'])) {
            $data['Comment'] = Convert::raw2sql($data['Comment']);
            $exists = Comment::get()
                ->filter(array('Comment:PartialMatch' => $data['Comment']))
                ->where('ABS(TIMEDIFF(NOW(), Created)) < 60');
            if (!$exists->count()) {
                $comment = Comment::create();
                $form->saveInto($comment);
                $comment->NewsID = $data['NewsID'];
                $comment->write();
            }
        }
        Controller::curr()->redirectBack();
    }
public function CommentStore ( $ data , $ form ) { /**
         * If the "Extra" field is filled, we have a bot.
         * Also, the nsas (<noscript> Anti Spam) is a bot. Bot's don't use javascript.
         * Note, a legitimate visitor that has JS disabled, will be unable to post!
         */ if ( ! isset ( $ data [ 'Extra' ] ) || $ data [ 'Extra' ] == '' || isset ( $ data [ 'nsas' ] ) ) { $ data [ 'Comment' ] = Convert :: raw2sql ( $ data [ 'Comment' ] ) ; $ exists = Comment :: get ( ) -> filter ( array ( 'Comment:PartialMatch' => $ data [ 'Comment' ] ) ) -> where ( 'ABS(TIMEDIFF(NOW(), Created)) < 60' ) ; if ( ! $ exists -> count ( ) ) { $ comment = Comment :: create ( ) ; $ form -> saveInto ( $ comment ) ; $ comment -> NewsID = $ data [ 'NewsID' ] ; $ comment -> write ( ) ; } } Controller :: curr ( ) -> redirectBack ( ) ; }
Store it.
And also check if it's no double-post. Limited to 60 seconds, but it can be differed.
I wonder if this is XSS safe? The saveInto does this for me, right?

@param array $data Posted data as array
@param Form $form FormObject containing the entire Form as an Object.
Store it . And also check if it s no double - post . Limited to 60 seconds but it can be differed . I wonder if this is XSS safe? The saveInto does this for me right?