In reply to a tweet by domenic:

@domenic my personal favorite is getting a form validation error on my last name, which I work around by doing the SQL escaping myself.