FormsAuthentication.GetRedirectUrl is a very strange method :) and I will explain why. Developing some stuff I needed to get redirectUrl on loging page. It can be made by simply taking "ReturnUrl" parameter from query string. But at some moment I found GetRedirectUrl method which I hoped would be better solution for my task. But what I saw when opened its parameters - string userName, bool createPersistentCookie! Why do we need those parameters for just taking single parameter from query string? I decided to look at the documentation first and then at reflector :) MSDN says that createPersistentCookie is ignored .. ok.. it's much better. But what about userName which is "required" by manual? Let's take a look at the reflector:

public static string GetRedirectUrl(string userName, bool createPersistentCookie)
{
   if (userName == null)
   {
      return null;
   }
   return GetReturnUrl(true);
}

So, what do we see here? - createPersistentCookie is never used thus it's really ignored as we suspected. But let's take a closer look at userName variable - it's just checked for null and nothing more! Now tell me... why should we use that parameter if it is not used anywhere? Why documentation doesn't say about what actually happens? I am confused. The result of my investigation was a decision to use that method in following manner:

string returnUrl = FormsAuthentication.GetRedirectUrl(String.Empty, false);

and it's working perfectly as I wanted :)

Set Mode property to "Encode"

To not allow users to input restricted characters use RegularExpressionValidator control and regular expression like this:
"[^/<>;]*".