For completeness.
(specifying what you'll accept) vs.
(specifying what you'll reject). Whitelisting is generally considered to be preferable because the list of things you know you want is generally easier to specify than the list of things you know you don't want. This is especially true when dealing with untrusted input because you can
know about all the crazy wacked-out $h!t people are going to throw at you, maliciously or stoopidly. (Though, one can argue that stoopidity is a form of negligent maliciousness...)