good point, thankyourosc2112 wrote:A good general security rule, when dealing with suspect input, is to have a list of allowed chars (A-Za-z0-9, etc), rather than a list of disallowed chars (more likely to overlook some chars when trying to disallow.) The allowed list would likely be shorter as well.