I did something very similar for work last summer and we basically realized the same thing - null-delimited fields seemed like the only way to really be safe.