Before you immediately comment "you can't trust the client!", please read the whole question.
I've been reading about how to prevent XSS attacks lately, and everything I've found says that the server should sanitize the data that will be put into the webpage. This would basically look like
addToDatabase(filter(userResponse)). Then the client can safely add display anything that it gets from the server.
I was wondering if it would be safe to store the potentially unsafe data in the server, and have the client filter it when it was received, like
addHTML(filter(serverResponse)). This would stop the data from being executed client-side, so no XSS would take place. I understand that anyone could simply remove that
filter, however all that would do is make themselves vulnerable. Since other clients would filter anything sent to them, a malicious client could could only disable their own filter and mess up themselves.
(I'm not talking about SQL injection prevention, that would be obviously have to be server-side)
To summarize: The server doesn't sanitize, but the clients sanitize whatever they receive.
Would this be safe?