The most effective solution is probably a mix of input validation and output encoding.
I don't know that you can depend on the client to implement effective XSS mitigations. Hopefully they do, but it's not something you can depend on.
The first question you want to ask is what you do with input that fails validation. Do you remove bad characters and let the rest of input continue? That will make your application unpredictable for the user, which never seems like a good idea.
Another thing to keep in mind is that your data may not always be displayed within HTML. What if your data is included in a PDF document or sent to a printer? Those systems will have their own formats and HTML encoding won't make sense.
Here is the approach I would recommend:
- Define the acceptable input in terms of size and character set.
- Define your behavior for invalid input.
- Validate input and either reject (recommended) or scrub
- Use safe methods to store the input in your datastore
There's a risk here that someone on your team may make the assumption because the data is in an internal datastore that it is safe and start using the data without doing proper encoding.