Ones that might be delimiters or prone to sql injection attacks.
Sometimes they're just stupid, like not permitting a space in the surname (like ::cough:: the US Department of Education).
Not so stupid if you want to do usernames in urls though … ala http://flickr.com/photos/hmarq/106945212/
Same with many of the special characters … http://somesite.com/username/profile, http://