img tag exploit for text request var