You can do the filtering either on input or output (or both if you want to be very careful). Both works, however I prefer filtering on output because (a) if a n

You can do the filtering either on input or output (or both if you want to be very careful). Both works, however I prefer filtering on output because (a) if a new way to conduct an XSS attack is discovered, I only need to update code, not data; (2) if tomorrow HTML gets replaced by a hypothetical future document format, I would need to refilter all my data if I only filter at input.