You can block those type of request directly from the router. To be able to do this, you will need to set it on WAF - Web Application Firewall.
A web application firewall (or WAF) filters, monitors, and blocks HTTP
traffic to and from a web application. A WAF is differentiated from a
regular firewall in that a WAF is able to filter the content of
specific web applications while regular firewalls serve as a safety
gate between servers. By inspecting HTTP traffic, it can prevent
attacks stemming from web application security flaws, such as SQL
injection, cross-site scripting (XSS), file inclusion, and security
More information can be found here
On WAF, you can also add exception whereby you can allow some type of url which contains js script but this is not recommended.