It is a good practice to verify that a variable you are planning to untaint has only bad characters (black listing) rather than check whether or not it has any good characters (white listing).

Question

Quizplus · Accepted Answer

It is safer to use white listing, as it ensures that only the expected input is allowed, while black listing can be more prone to error and allow unexpected input to slip through.

It Is a Good Practice to Verify That a Variable