Rather than trying to come up with a blacklist, which could keep shifting, why not use eg https://www.asciitable.com/ to create some regexes that only accept valid (to you) char ranges eg 0-9, a-z, A-Z and a reasonable set of punctuation chars, and reject all others ?