prevented javascript injections