Of course you must escape your outputs, get in-depth layers you don't even need now, track how data flows in your application, patch every known vulnerability,

Of course you must escape your outputs, get in-depth layers you don't even need now, track how data flows in your application, patch every known vulnerability, sandbox every single thing, implement capability - based security, and many more. I didn't mean otherwise. Filtering input is not sufficient. But it is not optional.