“html injection documentation”