Defeating this is easy and has nothing to do with doing this on the server side. All they have to do is compare a page that you serve to the Googlebot user agent and one to a bot or human that is not. The pages will be different and you will be caught and penalized for cloaking. It's that simple.