You would think that if all these sites were doing it for fear of an SQL injection attack, they would forbid the same small set of troublesome characters and allow the rest. But no. Some sites allow none. Others allow maybe a half-dozen, but which half-dozen varies from one to another!

So there's got to be more going on. And I'm not going to rule out laziness as a factor.