This looks like really loose white-listing (lots of stuff could get past).  Can checking be done in some other way?