fix code injection possibilities