If you can't get your users to put the string in quotes (sounds like that would indeed be a problem), then instead of expecting the string on the command line of your script, have the script read the string. Instead of:

 % your_script the string from the user that should not contain * char
+acters
[download]

Have them use your script like:

 % your_script
Enter string> the string from the user that shouldn't contain * charac
+ters
[download]

(Wait until a user enters a contraction instead of a "*" using your old invocation strategy.)