Every consequential action a player triggers has to be checked on the server, because the client can be made to lie. Here's how server-side validation actually stops exploits.