fix injection on sign in