This is one of the first things I discovered when I started writing code to interact with the Nostr protocol.  Apparently, most clients don't sanitize data.