Is Hiding Server Controls Enough ?

I was thinking about developing a workflow application yesterday and was
musing over the different approaches than one could take in restricting
specific actions on a ticket( Form ) at any said stage.

One approach I have used on other systems is to prevent the action buttons
appearing. For example, if one did not have the Role of Administrator, one
would be prevented from deleting a ticket not created by oneself.

However, it did occur to me that there was a possibility of manually
constructing the button code in the page which has been rendered to the
client.

If you have a button which was visible=false ( Not HTML hidden ), then would
it be possible to invoke the backend function by manually adding the tag/id
etc for this button ?

I guess I could experiement, but I wondered if there was an instant answer
available ?
--
Best Regards

The Inimitable Mr Newbie º¿º


.

Loading