filter - blacklisting vs whitelisting in form's input filtering and validation

Question

which is the preferred approach in sanitizing inputs coming from the user?

thank you!

Answer 1

WL is a best practice against BL whenever it is practicable.

The reason is simple: you can't be reasonably safe enumerating what it is not permitted, an attacker could always find a way you did not think about. If you can, say what is allowed for sure, it is simpler and much much safer !