script injection test