You may also want to consider if you want to remove bad characters, or allow good characters. There is a subtle difference. The first requires that you keep a list of all bad characters, and in the case of missing one will allow a bad character through. The second requires that you keep a list of good characters, and missing one will not allow a good input. Which failure mode is worse will help you make your decision.