character entity injection