client could attack fields