prevent client side script injection