fixed another code injection vulnerability