Is there a way to prevent user from entering script tag to the form?
Yes, escaping. It is one of the fundamental cornerstones of web security, and completely missing from the code in the question.
Take this example:
<a href="<?php echo $foo; ?>">
How do we know it’s actually a URL? Your colleague has said it should be a URL, but do we really know for sure? What if we got hacked?
Escaping allows us to guarantee it will always be a URL. Even if $foo contains javascript code, a phone number, PI to 300 digits, doesn’t matter. Escaping enforces expectations, even if the result is broken and mangled, it’s guaranteed to be a URL.
<a href="<?php echo esc_url( $foo ); ?>">
Now we can rest safely assured that nothing can break out of the href attribute, that the anchor tag won’t be used to insert arbitrary HTML. It might contain a malicious URL, but it will always be a URL ( http://img%20src=x%20onerror=alert(test) ).
Escape right at the moment of output or as close as is possible.
There are lots of other escaping functions provided by WordPress and by PHP, each appropriate for different situations, such as plaintext, numbers, etc