whitelist valid characters, instead of blackisting