In general the reason whitelisting is preferred over black is there are so many forms of encoding that it is very difficult to make the blacklist sufficiently comprehensive. For example, you need to know the various unicode expressions of your blacklist entries as well as ascii.
no subject
The OWASP ESAPI might be of use to you:
https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API