generating html using find and replace/regex safely is hard. escaping is easy. and the solution is to just not generate html using find and replace. You'll run into the exact same problem trying to do a bbcode/markdown/whatever parser using javascript
Client side rendering does help but mistakes are still regularly made. Sometimes by the app dev, sometimes by the framework dev.
You could probably go to an extreme and return all of your application data as sprites.