I would not replace bad chars. I think throwing an exception would make more sense (`400` status code).