On: Naughty Strings: A list of strings likely to cause issues as user-input data

[scatters]

   eval
   expr

I got nothing for "mocha", though. Edit: apparently (from below) there was a Yahoo! mail filter that replaced "expresso" [sic] with "mocha"; but either the story was misreported or the mail filter was wildly misconfigured. So the entry should be "expresso" [sic], perhaps.

[bsimpson → scatters]

Nope, it was a schema that would cause a URL to be interpreted as code; an alias for `javascript:`

https://www.obscure.org/javascript/archives/msg01369.html