I'd like to allow my users to send their WordPress login credentials along with their comment, as opposed to having to log in first, and then post their comment. I'm not really sure where to hook into here, and any help would be much appreciated.
My basic plan is to get the user's login and pass (and comment), log the user in (maybe during preprocess_comment), then supply the user id etc to the comment object, then let everything run as usual. But I'm wondering if I'm opening myself up to some kind of exploit by doing so. I understand that WordPress has a login form for a reason, and I'm hesitant to log the user in without going through the official form.