Use a whitelist instead of a blacklist for allowed characters