The output needs too be an integer? What the hell are you smoking? The majority of XSS attacks are from search queries. I think you need to take a look at the examples here:
https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
And for SQL injections...
...
Have you ever heard of second order attacks? Blind SQL injections? XSS? Session hijacking? There doesn't need to be user input for something to be exploited. This is why you filter output. If I wasn't at work (this place where I deal with hundreds of customers' SQL injected sites daily)...
no no no:
$getUserInfo = mysql_query("SELECT * FROM users WHERE id = '".$Comments['userid']."'");
Learn to switch everything over using prepared statements and you won't be vulnerable to SQL injections.
<?php
echo substr(str_shuffle('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$'), 0, 10);
?>
Much better password generator than the one posted:
http://www.autobots.biz/dev/result.php
Just refresh to get a new generated password.
Show table structure or the query you currently have first, then we can know the best way to do this. I would say use ORDER BY RAND() in the SELECT statement, but that is inefficient as you waste resources creating a temporary table.