code injection fix in timeout var