What is a common mistake when working with input validation?

A common mistake with input validation is blocking a list of known bad strings is easy to bypass and can reject legitimate data while still allowing attacks in contexts the filter did not anticipate. The safer approach is to design and test the behavior explicitly rather than assuming the platform or dependency will handle it automatically.