An output problem
XSS isn't about the input being "bad" — it's about the app writing untrusted data into HTML without encoding it. The fix is contextual output encoding: turn < into < so the browser shows it instead of running it. Frameworks that auto-escape templates (and a Content-Security-Policy as defence in depth) shut this down.
Tip: Reflected XSS needs the victim to open your link; stored XSS is worse — the payload is saved by the app (a comment, a profile) and fires for everyone who views it.