fixes
fixing autoexpand
fixed injection attack