PHP forms can be subverted if the programmer assumed hidden fields are secure variables. Exploit description included.