THIS IS NOT ABOUT XSS
Threat: Mallory enters control characters in a public web application text field that other users might use in a terminal program (via copy+paste or by running a script).
Another threat is a user enters a phishing domain (that is later displayed) and uses a RTL control character so that it looks non-phishy.
(Another minor reason is that Postgres barfs if a user enters the null character).
I looked at OWASP ESAPI Validator but it only validates ASCII chars (ex in the getValidPrintable() method).
It seems like there's no good reason to accept:
\u0000 - \u001F (except carriage return, line feed, horizontal tab)
\u007F - \u009F
Which others should I be concerned with?
Escaping / encoding on save is as incorrect as it is with XSS.