All they need to do is check the values the client is posted back are not too far out of the expected range, but no, instead the server just accepts any data sent from the client so you can jack your memory, say you're somewhere else, and the server just accepts it.