The broken form thing reminds me of when I tried to send a message to California FTB (basically the IRS for California).
Kept getting this cryptic error: "Field contains invalid characters or format."
Eventually I found through trial and error that the problem was APOSTROPHES. So I'm, it's, that's, they're, etc are all out.
It amazes me that not only do they not support such commonly used phrases in their messaging system (which pretty clearly means they've never tested it with any thing remotely resembling a real world message), but also that they couldn't even have the decency to give a more descriptive message so I didn't have to go on a punctuation whack-a-mole.
I found one of these once for a client I was doing some work for. It was an Ecommerce site as well and they had the "brilliant" idea of "solving" SQL injection by exiting early and stopping the page from loading if the URL contained an apostrophe... One URL encoded apostrophe later and 45 minutes wrangling T-SQL and I had a neat URL to show them at our next meeting with CCname in it.
For added fun, they used Authorize.net but instead of just storing a transaction ID in their infinite brilliance they decided to store name, number, expiry, and CVV code! They didn't even have user accounts or saved payments, it was all more or less a guest checkout flow for all their orders so customers couldn't even look this up on their site after the transaction. Once an order had been filled there wasn't even any usage of the old order data and they never deleted any of it. A quick row count showed ~750,000 entries going back for years.
People that do things like filtering all apostrophes in a form send shivers up my spine. God only knows what horrors lurk beneath the surface on that California government site.
Occasionally I see websites take issue with a odd number of ' because it's creating a SQL statement, and inserting my message/posting in a table within a database.
At least as of last year the FTB website still didn’t take parenthesis either. Pretty sure it is a ham-handed approach at sanitizing the input against sql injection.
Kept getting this cryptic error: "Field contains invalid characters or format."
Eventually I found through trial and error that the problem was APOSTROPHES. So I'm, it's, that's, they're, etc are all out.
It amazes me that not only do they not support such commonly used phrases in their messaging system (which pretty clearly means they've never tested it with any thing remotely resembling a real world message), but also that they couldn't even have the decency to give a more descriptive message so I didn't have to go on a punctuation whack-a-mole.