Even better to just use TSV. Hand-rolling XML or JSON is always a smell to me, even if it's visibly safe.
Using C0 codes is likely safer at least in the sense that you will probably think to check for those and there is no reason whatsoever for them to be found in user data.