A button may be always clicked programmatically. For example you may have a page with a form like this:

<form>

    <input type="text" />

    <button>Do something</button>

    <input type="submit">

</form>

then it is possible just to open debug console and type

document.getElementsByTagName('button')[0].click();

which will click the button, or

document.getElementsByTagName('input')[1].click();

which will click the submit button of the form, or just

document.forms[0].submit();

to submit the form without clicking the button.

There is no way to prevent user from mastering JavaScript code on client. You have to add some validation on server side in order to prevent unwanted user actions.