Multiple choice technology security

Why is “Black List” input validation considered a weak validation method ?

  1. Because the validation settings are hard coded.

  2. Susceptible to bypass using various forms of character encoding

  3. Because it's difficult to implement a black list filter that also takes into account data sent using the POST method

  4. Because it is typically implemented using regular expressions to match known good data patterns
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

Black list validation is weak because attackers can bypass it using various character encoding techniques (URL encoding, Unicode, double encoding, etc.) to represent blocked characters in ways the filter doesn't recognize. Being hard-coded (A) doesn't make it weak. POST method handling (C) isn't specifically problematic for black lists. Black lists don't match good patterns (D) - they block bad ones.

Keep practicing — related questions