HTML injection, userLink and keywordLink