Server side message data security

What is the best way to sanitize message content on the server side which is received from client as one of the query string parameters? This message is also meant to be resend to other connected clients so it have be secure in terms of code execution or inj开发者_Go百科ection (JavaScript or HTML) on server or client side.

To protect node.js against XSS I borrowed this from snippet jade:

/**
 * Escape the given string of `html`.
 *
 * @param {String} html
 * @return {String}
 * @api private
 */

function sanitize(html){
    return String(html)
        .replace(/&(?!\w+;)/g, '&')
        .replace(/</g, '&lt;')
        .replace(/>/g, '&gt;')
        .replace(/"/g, '&quot;');
}

P.S: You should always do proper server-side filtering

You could use node-validator, it looks like a more comprehensive solution to the aboce snippet.