diff --git a/app/rest/server.go b/app/rest/server.go
index 11f262bc..79aafb43 100644
--- a/app/rest/server.go
+++ b/app/rest/server.go
@@ -105,6 +105,9 @@ func (s *Server) createCommentCtrl(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	comment.ID = "" // don't allow user to define ID, force auto-gen
+	comment.Text = template.HTMLEscapeString(comment.Text)
+
 	comment.User.IP = strings.Split(r.RemoteAddr, ":")[0]
 	comment.User.ID = template.HTMLEscapeString(user.ID)
 	comment.User.Name = template.HTMLEscapeString(user.Name)
@@ -112,8 +115,6 @@ func (s *Server) createCommentCtrl(w http.ResponseWriter, r *http.Request) {
 	comment.User.Profile = template.HTMLEscapeString(user.Profile)
 	comment.User.Admin = user.Admin
 
-	comment.Text = template.HTMLEscapeString(comment.Text)
-
 	log.Printf("[INFO] create comment %+v", comment)
 
 	// check if user blocked
diff --git a/app/store/bolt.go b/app/store/bolt.go
index bff0c8c6..052be870 100644
--- a/app/store/bolt.go
+++ b/app/store/bolt.go
@@ -42,7 +42,10 @@ func NewBoltDB(dbFile string) (*BoltDB, error) {
 // Create saves new comment to store
 func (b *BoltDB) Create(comment Comment) (string, error) {
 
-	comment.ID = makeCommentID()
+	if comment.ID == "" {
+		comment.ID = makeCommentID()
+	}
+
 	comment.Timestamp = time.Now()
 	comment.Votes = make(map[string]bool)