reporting json injection