Please help with user comments and uploading photos.

A concise, practical plan follows to implement member reviews and controlled photo uploads (tags show PHP and database work), expanding on @Dani's CMS suggestion and @bobchrist's hosted-photo idea.

Start with a simple, normalized schema for reviews so aggregation, moderation and duplicates are easy to handle. Example table (SQL):

CREATE TABLE reviews (
  id INT AUTO_INCREMENT PRIMARY KEY,
  product_id INT NOT NULL,
  user_id INT NOT NULL,
  rating TINYINT NOT NULL CHECK (rating BETWEEN 1 AND 5),
  title VARCHAR(255),
  body TEXT,
  approved TINYINT(1) DEFAULT 0,
  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
  UNIQUE KEY ux_product_user (product_id, user_id),
  INDEX (product_id)
);

Key points: enforce a one-review-per-user-per-product UNIQUE constraint, store an approved flag for moderation, and compute product averages with an indexed aggregation or update cached columns on write.

For photo uploads, keep image files on disk (or object storage) and save metadata in a small table:

CREATE TABLE photos (
  id INT AUTO_INCREMENT PRIMARY KEY,
  product_id INT,
  user_id INT NOT NULL,
  filename VARCHAR(255) NOT NULL,
  width INT, height INT,
  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

Upload workflow: require authentication, validate MIME with getimagesize() (do not trust extensions), enforce max file size/dimensions, generate a unique filename (hash/UUID), move the file into a protected folder, then create a resized thumbnail with GD or ImageMagick and store both paths in the DB. Minimal PHP GD resize pattern:

$src = $_FILES['photo']['tmp_name'];
$srcImg = imagecreatefromjpeg($src);
$w = imagesx($srcImg); $h = imagesy($srcImg);
$ratio = min($maxW/$w, $maxH/$h);
$thumb = imagecreatetruecolor((int)($w*$ratio),(int)($h*$ratio));
imagecopyresampled($thumb,$srcImg,0,0,0,0,imagesx($thumb),imagesy($thumb),$w,$h);
imagejpeg($thumb,$dest,85);

Security/UX cautions: always use prepared statements, escape output to prevent XSS in reviews, protect uploads (whitelist MIME types, limit rate, scan if possible), use CSRF tokens, moderate or queue new content, and consider a CDN/cloud store for scale. If choosing a CMS/plugin as @Dani suggested, pick one that handles authentication, moderation and image processing to avoid reinventing those security-critical parts.