Question: I have a select element with 20+ options and size 10. I do not have the multiple attribute on the select. However a tester is able to select multiple options. The tester is using IE7 on Win XP.

How is this possible? 

Could the tester have a client override to enable this? 

**Update:**
In response to most of the comments.

* The select element isnt posted back its just used in some UI and javascript.
* The tester isnt doing anything out of the ordinary (firebug, headers)
* the html is your standard select element with a size attribute of 10 on it.

Answer: 
The tester might be playing around with the request headers, changing the number of options directly on them.

Another way to do this is use firebug/ie developer tools and dynamically add a `multiple="multiple"` attribute to the select, then select several options.

These are just *two* ways off the top of my head. Your tested might be doing something else entirely.

There is a reason why the phrase "never trust the client" is so popular.
**You need to check everything on the server**

Simple! You can't trust anything coming from the browser. If you expected one item to be selected, then check it on the server and display a message if not.

You're tester has uncovered a fundamental security issue with your site and I'd thank them for this.