Whitelist input data for a lookup by name I'm whitelisting the input data to an LDAP/AD search on 'sn' (=surname). The purpose is to stop penetration attacks through the app and into the LDAP servers (i.e. no brackets, please).

// whitelist input data.
string partialName = Regex.Replace(partialName, "[^. a-zA-Z-']", string.Empty);


Do you think this is a useful subset? I don't want to allow anything bad through but it does need to be usable.

UPDATE

Instead of whitelisting I should be escaping characters (@200_success):

// escape LDAP filter string characters.
partialName = 
    partialName
    .Replace(@"\", @"\5c")
    .Replace(@"*", @"\2a")
    .Replace(@"(", @"\28")
    .Replace(@")", @"\29");


This works against my LDAP server. I can't pass an asterisk anyway as the interface is a REST url and that causes a Request.Path exception.
Don't ever make assumptions of what to allow or disallow based on what you have seen in your experience.  Always consult the specification, which is, in this case, RFC 4515 Sec 3.  The spec will tell you which characters require escaping, and what the escaping mechanism is.