Protect against javascript code injection