Sounds good to me.  If we used this for escaping html attributes then we may want to escape :, to prevent href="javascript: "