In addition to scanning user uploaded files, I would also like to ensure that forms for user profiles, comments, etc. cannot be misused to submit malicious script. What are some known good methods of doing so? Should checking for script injection attacks (XSS and SQLi) be done client-side or server-side?
I have checked a few security-related modules in NPM, but they mostly seem to concern the security of other modules, and its possible I have missed something useful.
One way I am aware of is to strip out all HTML tags, but I think it is a bit heavy-handed as well as probably not effective in all cases.