IMHO it is clearer and safer to check that the string contains only valid characters, instead of checking if it contains invalid ones.

I disagree that it is safer, I find the one with less characters easier to read. Also your prefered method is slower. It is easier to find one bad apple than to look through and validate every one. The net result maybe the same but only in the 'worst case' senario. But that is only IHMO also.