yupp client side controls what can be used and it SHOULD be checked server side. If it's not checked server side then people will be able to edit their client and do all sorts of nasty things (eg: equip 2 backswords, use skills with wrong weps, use hurc without matching weps, etc)
When coding your server MAKE SURE you run all the proper checks. Also think about time between attacks... so few servers seem to run a check on attack rate meaning people using hacks can theoretically hit super fast using certain skills.... and obviously check movement/jump/walk speed. Speedhacks arent fun lol.