injection fix for backend.php