make sure to control the integrity of the hidden html field, and do not assume that just because it's hidden it automatically is out of reach to people. Better to control it twice, and at the serverside is a most. So in short get a habbit of not trusting the users.