like foo.com'onclick="alert('hi');"

But yeah the right way to do this is to use a well-tested urlencoding library, not to strip out dangerous-looking characters.