forbid js injection