remove directory injection
use embedded resources instead of content output