Test for code injection and escaping