fixed HTML injection