javascript injection test