title: Can a user edit the page source, manipulate hidden field values and then post the form with those values?
body: <p>On various sites, you often see in the page source some hidden values on forms (usually holding some kind of constant, key, ID, etc). Something like:</p>
  
  <pre><code>&lt;input type="hidden" name="_submit_check" value="1"&gt;
  </code></pre>
  
  <p>I'd assume this website is double checking the form was posted by checking _submit_checks value for 1. Would it be possible to edit the source and change that to 0, then post the data and thus make the form fail to post server side?</p>
  
  <p>This example isn't very dangerous to the server as it will simply ignore the request but are there any possible security risks with using hidden fields (other than the obvious: they can still read the value in the source, I'm more worried about if they can edit it).</p>