Fixed script injection flaw