Oh, where to begin...
If there's one tenet of security that proves itself again and again and again it's that blacklists fail.
Play the long game - sure your web-application may resist the limited number of attacks you threw at it today, but the internet is going to be able to try thousands of more things with thousands of more variables (new code, different browsers, different language sets, etc, etc, etc).
"The user input being validated is always" -- says you today. What happens when you move on and another developer inherits that code? Are they going to understand and honor the commitments you made to yourself in your head? If you do input validation and output encoding, you give the next guy a fighting chance.
Go ahead and strip out ""<script>", what happens when someone submits ""<scr<script>ipt>"" ?