more reliable html injection