"Purify HTML" on plain text fields Recently we've had someone/something trying to perform a XSS attack using a form which saves all data into sessionStorage and then sends it to a custom craft plugin to pair it with a user.

A solution to stop these XSS vulnerabilities from craft docs is to "enable all “Purify HTML?” Rich Text field settings" but I've noticed this option only exists for Rich Text fields.

So my question is, is it somehow possible to activate "Purify HTML" on plain text fields (and other types of input like select and checkboxes)? Or do I need to escape/encode these fields on the client side (and how)?
The reason there is a "Purify HTML?" setting only for Rich Text fields is that Twig will automatically escape the output of every other field by default, mitigating XSS attack vectors.

Rich Text fields, by nature, are designed to store HTML, therefore their output isn't escaped and you have to rely on things like "Purify HTML?" (which uses http://htmlpurifier.org/) to try and remove anything malicious looking.

If you're plugin needs to output data for a Plain Text field in a way that doesn't get escaped (for whatever reason), you can always run HTMLPurifier on it manually.