comment out html injection code