Why does Drupal url alias field allow apostrophes and passes validation?
Use hook_form_FORM_ID_alter() to add your own validation function to node edit forms. In this validation function you'd check for characters that you want to allow/deny, and throw a form_set_error() on that field if there's a problem.