When dealing with XSS concerns, it's important to stay focused on the fact that this is a client-side issue... So in regards to Craft, Twig is the star of the show.
Fortunately, Twig takes measures by default to ensure that your output is safe. For example, any time you're outputting some HTML code via a Twig variable, you're required to add a
raw filter to get the HTML to render properly. Otherwise, those special characters get encoded and simply rendered "as is" on the front-end. When you apply the
raw filter to a Twig variable, you're essentially telling Twig that you trust whatever data may be coming out of that variable.
Here are a few other Twig filters which may help you out:
Your question puts an emphasis on data input, which isn't typically where XSS issues are addressed. However, there are some things (as you noted) which can help you sort out incoming data.
Validating your data using Yii validation rules is a good start. And I believe the
CHtmlPurifier can be useful to you as well. Skimming through the Yii documentation, I believe this helper method can be applied to input data:
$purifier = new \CHtmlPurifier();
Simply apply that helper method to data as it's being stored in your Record, and that should make your data safe for future output.