Client side is required to handle inputs from server properly anyway and to use the proper API so that it doesn't interpret input as markup/code. For server ou

Client side is required to handle inputs from server properly anyway and to use the proper API so that it doesn't interpret input as markup/code. For server output it's optional, because preventing client side code injection is not its concern.