Validating names that could contain symbols ie potentially malicious javascript

See more:

C#

Javascript

One of my GUIs was giving a message “A potentially dangerous Request. Form value was detected from the client”
This is because names can contain <> characters.
To stop this message one can add ValidateRequest="false” to web.config.
This leaves the application vulnerable to malicious input eg

http://www.thegeekstuff.com/2012/02/xss-attack-examples/

If the GUI converts <> to escape characters the stored procedure will need to convert them back, so I could still get malicious javascript when the browser displays the name.

The only consolation I can think of is that the name is limited to 90 characters. How long would a string of javascript need to be to act maliciously?

This link gives some tags to look out for, but is not exhaustive.

http://msdn.microsoft.com/en-us/library/ff649310.aspx
Any suggestions? I'm using visual studio 2008 with asp.net 3.5 - C#