This is obviously a lot easier with the regular expression capabilities in XSLT 2.0. In 1.0, using translate(), there's a neat trick for *deleting* all characters outside a given set (say 0-9 for example):
translate($in, translate($in, '0123456789', ''), '')
which you can adapt by changing the last '' to a sufficiently-long string of spaces (and changing '0123...' to the set of characters you want to keep). Sufficiently-long means "at least as long as the number of different characters in $in", or if you prefer "at least as long as $in".
Michael Kay
http://www.saxonica.com/
Author, XSLT Programmer's Reference and XPath 2.0 Programmer's Reference