"as far as I know..." is the root of many bugs, failing to encode dangerous characters. It is the 'blacklist' approach to encode only the things you know are dangerous instead of not-encoding only the things you know are not dangerous.
For an example, imagine that the server sets an HTML tag attribute's value to user input...
The above is completely legal and valid HTML. Many web pages do not encapsulate their values in quotes, and browsers interpret this correctly.
Now, assume you use the OWASP list that you included at the top of the page. Note that space is not in the list....
<input value=foo onclick=alert()>
Just because you can't see where it would be a problem is never good enough. You MUST know that it can never be a problem before you let it through. As yu can see with the above example, even OWASP failed to predict certain valid usage of user data, and thier encoding instructions were incomplete.
The safe thing is to always encode everything but that which cannot possibly be dnagerous. Generally, it is safe to encode all non-alphanumeric ASCII characters below character point 127 and let everything else go unencoded. Less than this invites errors oike the one described above.