client side commands injection