If you write web apps, you should be used to treating user input as hostile. You just need to write your application with a clear perimeter around user supplied input.
Even with a server side DB, they could lie about their results or hack the game to do better.