updated to add the scenario where ISPs inject code