結果 : how to prevent script injection in javascript