refactored injection
refactored xss