input.*type=(\"|\')?hidden.*=.*request\.get(Parameter|QueryString)

User controlled input direct to output, possible cross-site scripting.