Fixed external html injection