Login system

Ones that might be delimiters or prone to sql injection attacks.

Sometimes they're just stupid, like not permitting a space in the
surname (like ::cough:: the US Department of Education).

Not so stupid if you want to do usernames in urls though … ala http://flickr.com/photos/hmarq/106945212/

Same with many of the special characters …
, http://