A trouble maker could write his own form that submits to your cgi. His input could be something that you completely did not expect. So even though you forced your options on the regular user you have to keep things like this in mind.