If you aren't using any custom form components, then the default ones are sanitized - so even if somebody will submit a text with e.g. some JS command, it will be just text, it will not be executed. Or, do you have any proof of concept?
One idea would be adding e.g. a custom Javascript code to the page to do the client side validation. Or, to do a server side validation, you can use the bizformitem event handler and e.g. in the before insert event check the submitted data, parse them and decide whether you want to save them or not.