Definitely use a battle-tested HTML sanitization library if possible. There's a million different pitfalls and footguns with XSS. See: Some of the insane XSS polyglots out there that can be used for testing.

https://github.com/0xsobky/HackVault/wiki/Unleashing-an-Ulti...