more work on user injection