untested member page html injection