preventing at least script injection