The website isn't using parameterized queries, which is a fairly serious security flaw. Most likely, your mother is putting a single quote in a field where the programmer didn't expect it, and because ...