made it "exploit-save" again

- added a bad characters check