How to prevent cross site script attacking?

I've watch a video here

And after that I was wondering how do I prevent that attack with ndoe.js and body-parser

Here is a short code and anybody can help me how to prevent this attack

Normal node.js form handle script

var express = require('express');
var app = express();

var bodyParser = require('body-parser');
app.use(bodyParser.urlencoded({ extended: false }));

app.get('/form', function(req, res) {
  res.send('<form action="/" method="post"><input type="text" name="input"><br /><input type="submit"></form>');
}

app.post('/', function(req, res) {
  res.send(req.body.input);
}

As the code above I can promise it can be attacked by cross site scripting but how to prevent??

Edit:

Sorry for unclear instruction, I update the above code with a URL /form to easily explain how the cross site script attacking (XSS) can be used

As the above code, we have a form which you can submit text to the url / and it'll print out the text (info) you type so just imagine if I type hello world! it'll just print out all the thing in your input for this one it's hello world!, but how about I type <script>alert("you have been attack");</script> my code will print out the text and then the browser will treat it as a javascript, not a text which means browser will run it, so I'm asking how to prevent this?