diff --git a/client/comment.js b/client/comment.js
new file mode 100644
index 0000000..4aef341
--- /dev/null
+++ b/client/comment.js
@@ -0,0 +1,25 @@
+import Route from "../route.js";
+import auth from "../form/auth.js";
+import initDb from "../db.js";
+
+let db = await initDb();
+
+let main = new Route([auth], async function (req, res, input) {
+    let {route} = req.params;
+    let {id} = req.query;
+    let { username } = input;
+
+    let comments = await db.all('SELECT * FROM comment WHERE targetType = ? AND targetId = ?', [
+        route,
+        id
+    ]);
+
+    return {
+        ...input,
+        route,
+        id,
+        comments
+    };
+});
+
+export default main;
\ No newline at end of file
diff --git a/client/player.js b/client/player.js
index cb6e4dc..014525d 100644
--- a/client/player.js
+++ b/client/player.js
@@ -1,17 +1,16 @@
 import Route from "../route.js";
-import auth from "../form/auth.js";
+import comment from "./comment.js";
 import initDb from "../db.js";
 
 let db = await initDb();
 
-let main = new Route([auth], async function (req, res, input) {
-    let { username } = input;
+let main = new Route([comment], async function (req, res, input) {
     let videoData = await db.all('SELECT * FROM video WHERE id = ?', [
         req.query.id
     ]);
     videoData = videoData[0];
     return res.render('player', {
-        username,
+        ...input,
         videoData
     });
 });
diff --git a/client/user.js b/client/user.js
index 024e2ae..99efc69 100644
--- a/client/user.js
+++ b/client/user.js
@@ -1,17 +1,16 @@
 import Route from "../route.js";
-import auth from "../form/auth.js";
+import comment from "./comment.js";
 import initDb from "../db.js";
 
 let db = await initDb();
 
-let main = new Route([auth], async function (req, res, input) {
+let main = new Route([comment], async function (req, res, input) {
     let { id } = req.query;
-    let { username } = input;
     let videos = await db.all('SELECT * FROM video WHERE username = ? ORDER BY date DESC', [
         req.query.id
     ]);
     return res.render('user', {
-        username,
+        ...input,
         id,
         videos
     });
diff --git a/db.js b/db.js
index 55a6d9e..5f0a8e1 100644
--- a/db.js
+++ b/db.js
@@ -15,6 +15,7 @@ async function initDb() {
     await db.run(`CREATE TABLE IF NOT EXISTS token (username TEXT, token TEXT);`);
 
     await db.run(`CREATE TABLE IF NOT EXISTS video (id TEXT, title TEXT, desc TEXT, username TEXT, date REAL);`);
+    await db.run('CREATE TABLE IF NOT EXISTS comment (username TEXT, targetType TEXT, targetId TEXT, date REAL, content TEXT, id TEXT);');
 
     return db;
 }
diff --git a/form/comment.js b/form/comment.js
new file mode 100644
index 0000000..71061e8
--- /dev/null
+++ b/form/comment.js
@@ -0,0 +1,33 @@
+import Route from "../route.js";
+import initDb from "../db.js";
+import { randomUUID } from 'node:crypto';
+import { exec } from 'node:child_process';
+import { promisify } from "node:util";
+import auth from "../form/auth.js";
+
+const execP = promisify(exec);
+
+let db = await initDb();
+
+// TODO: rewrite
+let main = new Route([auth], async function (req, res, input) {
+    let { username } = input;
+    let id = randomUUID();
+
+    let { targetType, targetId, content } = req.body;
+    if (!targetType || !targetId || !content || username == '!nobody')
+        return { 'success': false, 'message': 'Some fields are missing' }; // probably should not re-use these strings
+
+    await db.run('INSERT INTO comment (username, targetType, targetId, date, content, id) VALUES (?,?,?,?,?,?)', [
+        username,
+        targetType,
+        targetId,
+        +new Date(),
+        content,
+        id
+    ]);
+
+    res.send({ redir: `?` });
+});
+
+export default main;
\ No newline at end of file
diff --git a/form/upload.js b/form/upload.js
index ee4f446..20ec71b 100644
--- a/form/upload.js
+++ b/form/upload.js
@@ -15,7 +15,7 @@ let main = new Route([auth], async function (req, res, input) {
     let id = randomUUID();
 
     let { title, desc } = req.body;
-    if (!title || !desc || !req.file) return { 'success': false, 'message': 'Some fields are missing' }; // probably should not re-use these strings
+    if (!title || !desc || !req.file || username == '!nobody') return { 'success': false, 'message': 'Some fields are missing' }; // probably should not re-use these strings
 
     let {path} = req.file;
 
diff --git a/routes.js b/routes.js
index 3dc9328..183a233 100644
--- a/routes.js
+++ b/routes.js
@@ -9,6 +9,7 @@ import loginB from "./form/login.js";
 import registerB from "./form/register.js";
 import uploadB from "./form/upload.js";
 import auth from "./form/auth.js";
+import commentB from "./form/comment.js";
 
 const routes = {
     get: {},
@@ -30,7 +31,8 @@ routes.form = {
     login: loginB,
     register: registerB,
     upload: uploadB,
-    auth
+    auth,
+    comment: commentB
 };
 
 async function iterate(req, res, index) {
diff --git a/static/main.css b/static/main.css
index cf024ce..618a1ec 100644
--- a/static/main.css
+++ b/static/main.css
@@ -37,7 +37,8 @@ textarea,
 form,
 .video,
 .controls,
-.user {
+.user,
+.comment {
     border: solid var(--dark-2) 3px;
     border-radius: 5px;
 
diff --git a/views/comments.ejs b/views/comments.ejs
new file mode 100644
index 0000000..3bfcd87
--- /dev/null
+++ b/views/comments.ejs
@@ -0,0 +1,21 @@
+<form enctype='multipart/form-data' method='POST' action='/api/form/comment'>
+    <h1>Comments</h1>
+    <!-- probably component-ify this -->
+    <div class='form-message'></div>
+    <input name='targetId' hidden value='<%= id %>'>
+    <input name='targetType' hidden value='<%= route %>'>
+    <textarea name='content'></textarea>
+    <input type='submit'>
+
+    <% for (let comment of comments) { %>
+        <div class='comment'>
+            <div><b>
+                    <a href='/client/user?id=<%= comment.username %>'><%= comment.username %></a>
+                </b></div>
+            <div><b>
+                    <%= (new Date(comment.date)+'').split(/(GMT|UTC)/g)[0] %>
+                </b></div>
+            <pre><%= comment.content %></pre>
+        </div>
+        <% } %>
+</form>
\ No newline at end of file
diff --git a/views/player.ejs b/views/player.ejs
index 013ed15..0d337ab 100644
--- a/views/player.ejs
+++ b/views/player.ejs
@@ -19,4 +19,5 @@
             </a></div>
         <pre><%= videoData.desc %></pre>
     </div>
+    <%- include('comments.ejs') -%>
     <%- include('footer.ejs') -%>
\ No newline at end of file
diff --git a/views/user.ejs b/views/user.ejs
index bec47f3..017c7eb 100644
--- a/views/user.ejs
+++ b/views/user.ejs
@@ -14,4 +14,5 @@
             <%- include('videos.ejs') -%>
         </div>
     </div>
+    <%- include('comments.ejs') -%>
     <%- include('footer.ejs') -%>
\ No newline at end of file