There's nothing inherently wrong with a user entering <script src="http://evil.example.com/"> http://evil.example.com/"> </script> in most any field, so you're

There's nothing inherently wrong with a user entering <script src="http://evil.example.com/"> http://evil.example.com/"> </script> in most any field, so you're not talking input validation but instead input restriction. I'd rather have my outputs properly escaped that have arbitrary restrictions on my inputs.