html injection fix