[demetrius]

Also, forbid apostrophes, quotation marks and non-cp1252 characters in the message text, like my bank's website does. Apparently to prevent SQL injections.