We have a PHP web application and all of the user inputs are sanitized. We tested it within Burp tool and found no XSS vulnerabilities.
One of our security adviser tells us that when you type down any script within user input such as
<script>alert("Pop")</script> and it gives
200 header response then that means XSS vulnerability presents. Header response should be
4xx or 5xx but I am having doubt. In above scenario, we removed such code from user input and stored remaining information within database by sending back
Please let me know what could be response header when you found some XSS vulnerable scripts within user input upon form submission.