# Latex command escape

We are using latex for pdf generation on our server. I would like to increase the security of our system with latex command escaping for data content ie remove all latex / tex / xelatex executable code. My question is if it is enough to remove the '\' character? Or are there any other special characters I should remove as well?

You don't have to remove them, just use \detokenize{...} around all unknown data then \ (and ^ which you also need to make safe) will just be normal characters that that typeset as themselves) (you probably want to make % catcode 12 as well.
• @sherif I was assuming the incoming data was plain text without any tex commands so wouldn't have any tex commands needing {} – David Carlisle Nov 20 '17 at 18:22
• @sherif probably not, if you make ^ and \  safe then you can't access any tex commands other than active characters for things like utf8 decoding, although it depends what you mean by dangerous null (ascii 0) is by default has teh catcode of an invalid character so if you get it on input you will get a tex error (it can't redefine anything but it might stop your job) – David Carlisle Nov 23 '17 at 13:54