tried preventing javascript injection