No, CGI doesn't remove anything. It couldn't possible know what would consist a bad character pattern because that varies by context. For example, the field I'm typing into right now expects an large HTML subset, so "<" is not a bad character for this field, but it wouldn't be acceptable for a person's name.