This is what I always tell people. If something is obviously sketchy, don't bother trying to make it safe. Just discard it. No reason to play the attacker's game. (Obviously you need to know what inputs are sketchy vs just uncommon, like people with a single quote in their last name)