I am building a web application, in which I am required to let user enter any character(even special characters - ~!@#$%^&*()_-+=|{}[];:'"<,.>) in an input field. To mitigate the problems caused by them, I am taking care of two things -

1. SQL injection - using parameterized queries
2. Cross Site Scripting - HTML escaping user input before adding it to DOM.

Is it sufficient or am I missing something?

Thanks