fixed script injection