preventing malicious user input

[Stimp]

I have an input field, which will ultimately be stored in a database
and the contents of which will be output on screen at some stage.

ASP.NET has built-in functionality to prevent users inputing values
such as "<script>", etc, to call malicious code, but I'd prefer to back
this up with my own input validation.

I'll deny < and > characters on input.. any other
strings/characters to look for?

Thanks!

 

[Mark]

What about using parameters?
Would that lessen the risk?