Special characters and escape codes often complicate this process, as each of those interfaces is a potential trouble spot. If it isn't translated into its escape code at this point, it will not render in the browser. Single quotation marks will generally pass fine until they reach the database, where they will confuse SQL if not handled properly. Any characters with special meanings such as this will need to be intercepted and translated or otherwise modified to prevent them from causing problems later in the workflow. On the way back through the workflow, any such translations need to be reversed.
Similar problems can pop up with quotation marks, ampersands, and line breaks.
What You Don't Know Despite thorough testing, some errors are inevitable. In order to make troubleshooting more effective, you need to include thorough exception handling and error reporting when you build your site. The Web is notorious for only providing limited error information, particularly about the client and status. Based on a stateless model, just keeping track of a particular user session requires convoluted token-passing schemes. Although application servers now hide much of the mechanics of this token passing from you, you can still feel its effects on session management.