fix possible injection issue