Use stable replacement loop for all multi-character patterns to prevent malicious input from reappearing after sanitization.