*shrugs* Stripping out unsafe characters just seems like a better idea; you know exactly what you're left with. If you want to allow single ticks or other characters, modifying the regex of allowed chars is easy. The code above is just an example, not a final product.