javascript injection fix