fix code injection