not vulnerable to AS injection