If I'm sanitizing strings, I typically just replace everything that I don't like with an underscore:

Please note -- I specifically deal with a negated class that contains the acceptable characters, rather than trying to maintain a list of which potentially bad characters I might have to deal with, to ensure that I don't miss anything that might be bad.

If you had to ensure the process was reversable in the future, I'd use something similar to URI encoding. (although probably not URI encoding, as I don't trust % normally.)