testing code injection