//Use the pathauto module to snaitise your string
if (module_exists('pathauto')) {
  // add the pathauto.inc file
  require_once(drupal_get_path('module', 'pathauto') . '/pathauto.inc');
  $termclean = pathauto_cleanstring('&%No thanks');
}

//use CTools to sanitise string - but without stripping stuff out		
ctools_include('cleanstring');
$sanestring = ctools_cleanstring('My raw string');

Drupal clean strings from template files

drupal

PHP