Your paranoia is more generous than mine. Such restrictions always make me assume that they don't know how to properly sanitize data for their database, so they just disallow such characters rather than learn how.