I haven't visited either site, but I sure hope he doesn't have logins or gather any sensitive user information if he has no CS background, no prior dev experien

I haven't visited either site, but I sure hope he doesn't have logins or gather any sensitive user information if he has no CS background, no prior dev experience, and is running entirely on vanilla JS/PHP using no frameworks. That combo sounds like an ideal recipe for a security nightmare.