XSS on page for internal use?

Question

JavaScript

I want to use <code> tag in internal use page to view user data.
How much will this tag protect against xss?

Answer 1

If there is no escaping or filtering besides the <code> tag, then it will not help at all. Nobody hinders to write </c⁠ode>alert(1);
And if there is a normal screening of an output that and <code> is not obligatory.

Answer 2

No
sanitizing of user input is done before saving to the database