So, you still haven't answered my question. Is there a built-in that can handle this?
It seems like software immaturity to me if the report engine fails on disallowed characters. Having to escape all data by myself implies a lot of work which should be handled by the framework.