In addition to scanning user uploaded files, I would also like to ensure that forms for user profiles, comments, etc. cannot be misused to submit malicious script. What are some known good methods of doing so? Should checking for script injection attacks be done client side or server side?
FWIW, I have checked a few security related modules in NPM, but they mostly seem to concern security of other modules, and its possible I have missed something useful.
One way I am aware of, is to strip out all HTML tags, but I think it is a bit heavy handed as well as probably not effective in all cases.
Update: As the question stood, it probably gave the impression of being about xss, despite the injection tag. So this is just to clear up that it is about both xss, as well as sql injection.