Always filter, not escape. Escaping input is of course path to nowhere, because you never know what kind of context your data will be displayed in. So, you can

Always filter, not escape. Escaping input is of course path to nowhere, because you never know what kind of context your data will be displayed in. So, you cannot guess proper escaping rules. Escaping data on input is novice mistake. Not having unfiltered data, reject data not conforming to some rules, so you know exactly what to expect getting you somewhere. You can bake checks and constraints into your database model too if it is needed.