Care Pathways reports

http://manage.dimagi.com/default.asp?124276
Is this key always coming from a safe source (e.g., not from a web page submission)? Is it possible that it could ever contain illegal identifier characters such as `'` (quote)?