We have InfoPath forms implemented in several areas of the site to submit requests. An example is a Request form to ask a question to a staff member who can reply to the message as well.
There is the possibility that someone can enter in JavaScript, such as (<script> alert(“attack”)
</script>) in one of the editable controls ...