A develоper is аsked tо review а lоgin endpoint. The code аlready sends the username and password to the database as bound parameters (placeholders), so the values are never concatenated into the query text. A teammate proposes ALSO adding a strict allow-list that rejects any username containing characters outside [A-Za-z0-9_@] before the query runs. From a secure-design standpoint, what is the best characterization of adding this allow-list? Select the ONE best answer.