js and image can not security