It can get even worse: When users copy and paste texts from web pages into Progress widgets they might even include all other sorts of invisible funky characters (HTML formatting). In an application that I developed some years ago I needed to implement such a sanitizer to prevent unwanted characters from being stored in the database without the users noticing.
The only way that holds water that I know of is to parse the text and remove all unwanted characters. Usually, depending on the code page, you would define a set of valid characters and remove all characters that are not valid. If you look into the character set of your code page and the code page you will find reserved ranges (ASCII codes) which are reserved for control sequences. But, most likely, your problem is even more complex as I suppose that the code page used in MS Word is different than the one used by your Progress application - and that most likely is the reason as to why the TAB character in MS Word ends up being some "funky" character in the Progress application that is not visible to the users. Therefore probably searching for the TAB character with it's ASCII code in the code page used by the Progress application won't yield a result.
That's the reason why that sanitizer compared each single character in the text against the set of valid characters and popped up an error message to the users so that they could not paste the text into the widget. They were advised to paste the test into notepad first and from there copy and paste it into the Progress widgets. But as most users didn't follow that advice as they tend to be lazy when it comes to follow guidelines they don't understand, we enforced it by popping up that error message effectively preventing the users from pasting invalid characters into Progress widgets. Furthermore, personally, I don't like the idea of silently modifying user input through business logic - another reason for the error message popping up.
I don't have access to the code anymore therefore I can't supply you a sample but I think you should get an idea what you are dealing with and from there decide what you need to implement.
Heavy Regards, RealHeavyDude.