Does this really work? Any arbitrary fixed-length prefix?

I always just serialize the inputs with JSON or something. Any weirdness an attacker might try would just be escaped so they'll never be able to match the original input.