what's wrong with rejecting no characters and using escaping/encoding to avoid injection problems etc? that catches every possible edge case - even the ones I d

what's wrong with rejecting no characters and using escaping/encoding to avoid injection problems etc? that catches every possible edge case - even the ones I don't know yet. the hard problem is validating the data - but you don't actually have to do it.