>OK, suppose we are using Rick's idea where result sets and update sets are bundled up and passed back and forth via HTTP. How do you damage the server files?
>

Nothing is hack-proof. There are other ways to get to the server....