Can I prevent Server variables from being spoofed ?

Can the server variable 'user agent' be modified/spoofed by the user? I have a bunch movies that I want to only open if the user agent contains Quicktime Player... In my case, if the user agent string contains Quicktime Player, a movie url is written for Quicktime to open.... If the user agent contains a browser, I want php to deny access....not write the url for Quicktime to read is is possible for a script kiddie to spoof user agent server variables to fool the server ? many thanks :) g