code injection buffers reset on each request