Does this really work? Any arbitrary fixed-length prefix? I always just serialize the inputs with JSON or something. Any weirdness an attacker might try would

Does this really work? Any arbitrary fixed-length prefix? I always just serialize the inputs with JSON or something. Any weirdness an attacker might try would just be escaped so they'll never be able to match the original input.