This is the solution I chose in the end:
Note! this is Struts 1.3.1 syntax for a validator mask!
^[^&><\\*?%:!"#$()+,;=@\[\]{}~\^|`\n\t\r/]+$
Disallowing special characters, allowing others.
This was considered as a white-list approach, but was neglected as it needed work (adding other languages other than European and Japanese/Chinese):
^[a-zA-Z0-9\-'àÀâÂäÄáÁéÉèÈêÊëËìÌîÎïÏòóÒôÔöÖùúÙûÛüÜçÇ’ñß]+|[一-龠]+|[ぁ-ゔ]+|[ァ-ヴー]+|[々〆〤]+$