Your question shows a misguided understanding of XSS.
It is important for you to understand the basic mechanism of the exploit. User input data (from URL, cookies, post data, Etc. Can enter the program and thereafter be used to attack your users, your server or your business.
You need to identify every place where this input data appears, and subject it to a check such as a character whitelist (eg regex match). This will prevent injection flaws of any type, including XSS.
- Transforming < to < etc.
- And then transform the whitelisted sequences back, e.g <B> back to <B> and so forth.
I hope you find this helpful. I am an application security expert with ten years’ experience.