add protection against form injection attacks