[rohanprabhu]

Not sanitizing input, by either scrubbing out any <script> tags, or escaping those characterst to html entities.

[kolme]

Please don't "sanitize" input, just escape accordingly.

"<script>" might be a legitimate input.

[eterm]

You need both. Sometimes the legit input is HTML such as from rich text editors. In those cases if someone types a bold <script> then the form should submit the escaped <b>&lt;script&gt;<b> but also needs to sanitise to make sure that other HTML element types are not present.

If you escape one step further you'll lose formatting or the message, so sanitisation is important too, it is reductive to say "always escape never sanitise".