There aren't lists I know of, but the usual practice is to have a default deny...that is, strip out anything that you don't explicitly allow. So something like:

my $text = $q->param('text');

# Removes any character that ISN'T a digit, word, or space character 
$text =~ s/[^\d\w\s]+//g;
[download]

In the end though, what characters to allow/disallow all depends on how you are using the data later. Maybe you could explain this more?