Or the author heard that you need to 'sanitize inputs' and equated that with trying to completely validate all incoming input (i.e. trying to figure out if a name is valid/invalid rather than just escaping it properly).

Or the PHB saw that you could enter a character that 'no one' would have in their name, and demanded something like Amazon/eBay/<popular website that PHB uses> has on their forms.