I imagine that any decent input checking library mark these as suspicious and block it.
He could try HughButActuallyYuFU