[tgv]

They just don't know how to get text unscrambled from a browser or an app's text box in server memory. That always makes me think they don't understand the design of what they're using, so they just forbid certain characters.

When they forbid backslashes and quotes, it's even better: someone didn't know how to use query parameters or escape database values. It's a sign that their software is as secure as a "watch out for the dog" sign.