My point was that the web page that the researcher compromised takes input from user and creates a neon version of it. It should be just fine to pass in any ch

My point was that the web page that the researcher compromised takes input from user and creates a neon version of it. It should be just fine to pass in any character to the site, so a regex deny list is the wrong approach.