server-side basic validation, no haxing, guys! =D