title: Prevent XSS by preventing HTML tags in GET/POST
body: <p>Is it possible to prevent <b>XSS attack</b> simply be preventing any <b>HTML tag (encoded/not encoded)</b> in <b>GET/POST inputs</b>? Also, no (intentional) dynamic data from server side contains any HTML tag.</p>
  
  <p>HTML tags can be prevented simply by a <b>middleware</b> that checks for if any html tag is presented in any <b>GET/POST</b> request.</p>
  
  <p>All my <b>static strings are safe</b> and only dynamic strings are what i have to worry about, and <b>dynamic strings</b> either come from the <b>client (with GET/POST requests)</b> or come from the <b>database</b>, then if i can ensure that non of these characters <b>[", ', &lt;, >, &amp;]</b> are in any dynamic string coming from <b>client or from database</b>, will I be able to avoid XSS?</p>