Fine

Technical it is.
on $*:text:/^!XP ([^\s]+) ([0-9]{1,})$/Si:#: {
var %a = $regml(1) , %b = $regml(2) , %stats = $calc( $readini(Stats.ini,XP,%a) + %b )
writeini Stats.ini XP %a %stats
msg # Total stats for %a $+ : %stats
}
That's about as secure as I can make it.

Though I'm sure someone like FiberOPtics could make it a little better.
This will remove control codes, and will be case insensitive. But will only trigger if you type: !XP <whatever> <numbers_here>