We have an application with a form where user can enter a comment. The form is submitted using AJAX. Values are read also through AJAX and returned by the backend as JSON, and then parsed by JavaScript to present it on the page.
This form was vulnerable of XSS attack so we protected the application on the frontend only, we escape HTML and JavaScript characters when we parse JSON response.
We think that there is no need to do similar thing on the backend, i.e., to escape risky characters before storing them in the DB, because the JSON response will always be parsed by the frontend before rendering.
Is it correct approach or there is some threat or attack still possible?