I'm almost tempted to point him to URI::Escape or CGI.pm's facilities, but there's also String::Escape. I've used all three, with varying results, depending on what exactly he's trying to escape, strings, form elements, or URI structures.