if\(!sessionStorage[^<]+<\/script>\n?/', '', $html); // Inject token into sessionStorage right after so it's available // before any other script runs — including Rocket Loader $inject = ''; $html = str_replace('', '' . $inject, $html); echo $html;