header and form injection now working