It's possible but the client would have to be either stupid or not very technically inclined to be sure it would work. Depending on how he coded things it would be trivial to remove or block access to it so it could not be executed. Regardless, I don't think I'd allow someone to do that. It's dangerous.
|