Even if you could manage to list out every possible SQL injection or XSS attack string, someone could come up with a brand-new attack technique and render your list obsolete. A much better strategy is to employ whitelist validation. True False