You might want to include common unix shell commands. At a previous job we had a customer with the last name of Echo who wasn't able to make a purchase. Turns out our credit card processor blocked them.
Turns out they were using a synchronous HTTP request with NO timeout, and their intrusion detection system was blackholing any request that contained 'cgi-bin' anywhere in the headers or body.
For example (I trust HN is suitably hardened :-) :
/dev/null; touch /tmp/blns.fail ; echo
1;DROP TABLE users
(Sure, people generally shouldn't use this test input outside of a discardable testing environment, but if we could rely on "People shouldn't..." clauses to govern behaviour then much of this list would be unnecessary anyway.)
> "Dropping a table is like checking a gun without bullets. It should not work, but just don't put it against your head while testing."
HN doesn't use a database.
It's written in Arc though, so it may take some effort to read.