Why does Drupal url alias field allow apostrophes and passes validation? In the node creation form, when a user unchecks the "Automatic alias" checkbox, the user can put apostrophe and other punctuation marks, which is not good in a URL.

How can I prevent this from happening?
Use hook_form_FORM_ID_alter() to add your own validation function to node edit forms. In this validation function you'd check for characters that you want to allow/deny, and throw a form_set_error() on that field if there's a problem.