title: How to reject names (people and companies) using whitelists with C# regex's?
body: <p>I've run into a few problems using a C# regex to implement a whitelist of allowed characters on web inputs. I am trying to avoid SQL injection and XSS attacks. I've read that whitelists of the allowable characters are the way to go.</p>
  
  <p>The inputs are people names and company names.</p>
  
  <p>Some of the problems are:</p>
  
  <ol>
  <li><p>Company names that have ampersands. Like "Jim &amp; Sons". The ampersand is important, but it is risky.</p></li>
  <li><p>Unicode characters in names (we have asian customers for example), that enter their names using their character sets. I need to whitelist all these.</p></li>
  <li>Company names can have all kinds of slashes, like "S/A" and "S\A". Are those risky?</li>
  </ol>
  
  <p>I find myself wanting to allow almost every character after seeing all the data that is in the DB already (and being entered by new users).</p>
  
  <p>Any suggestions for a good whitelist that will handle these (and other) issues?</p>
  
  <p>NOTE: It's a legacy system, so I don't have control of all the code. I was hoping to reduce the number of attacks by preventing bad data from getting into the system in the first place.</p>