Some general rules:

• Don't try to identify malicious content. Identify valid content for your fields, and discard everything else. A field named "store" is unlikely to require any of the critical characters <>&.
• If you include form fields in a response, you need to HTML-escape them as you would for your own texts. HTML-encoding "&lt" is different from URL-encoding "%3C". If you build href or other URL attributes, you need to apply both encodings on top of each other.
• Be aware that attackers don't use a browser to construct their URLs. Validating form fields with HTML data types or JavaScript is nice for convenience, but doesn't help for your application's security.