fixed javascript injection prevention