While what you're saying is true and what I said is not what is actually happening, I don't think you understood what I was trying to describe. And even though that's the case, I may still be wrong.

I understand that client-side validation is only a cosmetic, first-round attempt at sanitation.

My understanding (which is wrong) was that the malicious script was being injected into the html input where it was finally rendered and at the same time invoked. I was suggesting that the contents of an input (the value) should never be rendered (and as a result, activated) as any other contents outside of an input is rendered.

Even if content within an input is never rendered, it makes little difference since the attack is able to inject the script in other places outside of an input anyways.

So as others pointed out, nothing to do with inputs.