[stable31] fix: Only keep allowed characters in appid, and flag the method as escaping

[stable31] fix: Only keep allowed characters in appid, and flag the method as escaping #5446