removed html injection