Some examples that might confuse a client:

<script>alert("Hello");</script>

accented chars: 

indentation:

x
 x
  x
   x
    x
     x
      x
       x
        x