A blacklist seems problematic. Are you sure you don't want a whitelist - the set of entities which are allowed, and then everything else gets encoded?