They will only see whatever the php script outputs. Puts out. Well, you know what I mean As an example, look at the source of this forum. No php tags visible Hehe, sure, maybe I can already offer some explanations on point 4 in advance (I'm bored / overworked, so I take my time):
If someone posts comments, they have to be caught in the PHP script, and assigned to a variable, like $comment. You can then use "$comment = strip_tags($comment)", which will delete all HTML-Tags from a comment, to prevent entering <script>-Tags and stuff. Or you can use htmlspecialchars to convert < to < etc., so it will be shown in the comment instead of removed, but it won't be interpreted by your browser. I assume that's what they do on these boards, as I could write <script> and it is still readable
Then you can use "$comment = mysql_real_escape_string($comment)", which escapes ", ' and the like to \", \' etc., so SQL injection attacks are more difficult. (When later on displaying comments containing escaped characters, you may have to use strip_slashes on them first to remove the escapes again.)
On preparing a statement for mySql: See here. I.e. you'd use
$stmt = $mysqli->prepare("CALL sp_insert_comment(?)")
$stmt->bind_param('s', $comment);
$stmt->execute();
$stmt->close();
I hope that will help you when you're implementing