Let me emphasize that any user agent is free to send any HTTP request to your server - for example they can send POST and GET parameters that appear nowhere on your page, values that appear in no drop down list, and they can query URLs that are nowhere linked.
If you don't know this, you might have many security holes in your scripts.