He can just type any url he happens to know (from other PC's, from friends, whatever). And there are lots of adult sites without xxx in the name (I won't supply examples here). Typing the ip-address generally works just as well, although are more difficult to remember (but not more difficult to write down).
All I can advise the OP: search for parental control software. The ultimate ones have a positive list, only allowing the sites the parent (or, in this case, grandparent) vetted, like google and youtube and facebook (what more does a 13 year boy need?). Those that rely on an exclusion list are less reliable, because they hardly can contain all such sites all over the world.