thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Denylist Validation

Input validation that rejects values matching known-bad patterns and accepts everything else.

Definition

Also called negative validation or blocklisting, denylists are easily bypassed with encoding tricks, case changes or new attack variants. They can supplement but should not replace allowlist validation and context-aware encoding.

Example

Blocking the string '<script>' fails against '<img src=x onerror=...>' style payloads.

Exam tip

Denylists are the weaker answer; expect them to be distractors.

Related terms