Rather than "regex replace out" problematic elements, you should immediately toss the data back to the user for correction. Trying to "correct" a potential hack

Rather than "regex replace out" problematic elements, you should immediately toss the data back to the user for correction. Trying to "correct" a potential hacker's string is often a losing proposition.