I've run into a few problems using a C# regex to implement a whitelist of allowed characters on web inputs. I am trying to avoid SQL injection and XSS attacks. I've read that whitelists of the allowable characters are the way to go.

The inputs are people names and company names.

Some of the problems are:

1. Company names that have ampersands. Like "Jim & Sons". The ampersand is important, but it is risky.
2. Unicode characters in names (we have asian customers for example), that enter their names using their character sets. I need to whitelist all these.
3. Company names can have all kinds of slashes, like "S/A" and "S\A". Are those risky?

I find myself wanting to allow almost every character after seeing all the data that is in the DB already (and being entered by new users).

Any suggestions for a good whitelist that will handle these (and other) issues?

NOTE: It's a legacy system, so I don't have control of all the code. I was hoping to reduce the number of attacks by preventing bad data from getting into the system in the first place.