we talked about this on IRC but I think we agree we should do a stricter check of input (white-list vs blacklist) then allow numbers * and #

@etiennesegonzac what do you think?