Hopefully request validation is on <script>alert("hi")</script>