What is the best regular expression for a general textbox to all pretty much anything that won't allow a hacker to hack

Would it be correct to say that literally every textbox on a web form needs validation to keep a hacker from embedding a Javascript routine?  If so, what is the best general expression for a textbox where you don't realy want any limitations, such as a comments textbox.
 
Thanks 
...