restore html injection