Whether the programmer is using hidden fields or PATH_INFO, it's important to check all user-supplied data on the server side.

Server side validation is essential for all Web development where untrusted users might access your site. Reference: The WWW Security FAQ.