fix some possible javascript injections