Ashley wrote: > set one in onchange > > That's a javascript event, and shouldn't be relied upon for this sort of thing really. And my useragent is allowed to send arbitrary data to your server. you *must* deal with it.