The APEX_ESCAPE package uses the following constants.

c_ldap_dn_reserved_chars constant varchar2(8) := '"+,;<=>\'; 
c_ldap_search_reserved_chars constant varchar2(5) := '*()\/'; 
c_html_allowlist_tags constant varchar2(255) := '<h1>,</h1>,<h2>,</h2>,<h3>,</h3>,<h4>,</h4>,<p>,</p>,<b>,</b>,<strong>,</strong>,<i>,</i>,<ul>,</ul>,<ol>,</ol>,<li>,</li>,<br />,<hr/>';