crude input validation against a blacklist