test for html attributes injection