Configuration form, Disallowed Characters aren't saved

I'm trying to set the disallowed characters to: []{}|~`@#$%^*(")';=
On Save Configuration the string goes back to the default: []{}|
I'm guessing this has something to do with escaping the characters?
Maybe I just don't understand how this feature is supposed to work.
TIA