Whitelist input data for a lookup by name
Don't ever make assumptions of what to allow or disallow based on what you have seen in your experience.  Always consult the specification, which is, in this case, RFC 4515 Sec 3.  The spec will tell you which characters require escaping, and what the escaping mechanism is.