They are probably trying to make it look like they got hit by a clever attack, rather than SQLi or a XSS.