fixed injection attack