sanitize: escape only needed characters + test

Current implementation of `.sanitize` escapes many characters that not need to be escaped, including whitespaces and all non-basic ASCII letters. It works well, but resulting regexp is less readable and, I suppose, it would be faster to replace less strings.