I am working on building an application which will be used in various language , to secure from attacks like xss, SQL injection I thought implementing character filteration (whitelisting/blacking) but not sure if putting validation based on alphanumeric character is best way or not as non English characters might get rejected. what's the right way to handle this?
Trying to duct tape "more security" by trying to guess what is safe and what is not is going to fail.
The only way to make sure you don't get code injected through input is to treat input as data and never mix it with code, whether it might be safe or not.
For SQL that means prepared statements.
For XSS attacks it gets a little trickier because there is no such easy option. But the basic rules are the same. Do not mix data and program logic.
So to summarize: Do not try to best-guess what of your input is safe to treat as code. Never treat it as code. Separate code and (input) data and you don't have to worry about other languages and character encodings.