Sure, I've said this a few times because I'm talking to various people, in my perception of how posting here works. Your assumption that everyone shares in com

Sure, I've said this a few times because I'm talking to various people, in my perception of how posting here works. Your assumption that everyone shares in common sense equally is a bit optimistic. So, then you must agree that they clearly don't understand, as you say "the user can request anything at any time no matter what links we have or haven't generated or what they can see on screen". To me, this shows a lack of understanding of basic guidelines of web programming, namely that you can never, never trust user input, whether it's form submissions or cookies. Perhaps not common sense, but nor is it an advanced principle. If you've ever used Firebug for more than a couple of hours, you'd have figured out on your own that you can change forms and then submit them. If you've even used a browser for a while, you will have realized you can type in different numbers in query strings. If they haven't noticed that by now - what are they doing taking on a project like this?