Ought to do the @ as well, I suppose. Not sure about the &?

Neither am I. We could start a long discussion here involving eg quotemeta. But I suggest that we go no further down this line, and just accept to follow Corion's excellent advice above :

...it is a much saner approach to only allow what is permitted instead of rejecting what you know is bad.