What special characters need to be disabled for input in Input?

Question

Information Security

Maybe someone has their own tables of special characters that you definitely need to disable for input in inputs? For example, in such fields as Logs and Password. I would be grateful if you throw it off, because I found a lot of tables, but they are very pancake and contain unnecessary information.

Answer 1

It is necessary to prohibit all characters, except for characters from the white list of the type a-zA-Z0-9_
The check must be on the server. On the client, verification is needed, only in order not to reload the page once again.

Answer 2

the login must be a valid identifier, and the password has no restrictions, except for the length

Answer 3

It is almost useless to forbid anything to be entered into the inputs, checks in any case should work on the principle of filtering / validating all user-entered data on the server. Entering "forbidden" data into an input or simply sending it to the server without any input is not a problem at all.