Forbidden characters check in url and variables