I thought they could be, but as I\'m not putting my money where my mouth was (so to speak) setting the readonly attribute doesn\'t actually seem to do anything.
I\'d
But you absolutely MUST validate the data on the server to ensure it hasn't been changed.