fix trailing 11
fix missing $upload injection