I would amend that slightly: It's okay, but mostly a waste of time, to sanitize data before storing it. You must sanitize data when outputting it. Why? Beca

I would amend that slightly: It's okay, but mostly a waste of time, to sanitize data before storing it. You must sanitize data when outputting it. Why? Because someone could get the data into storage in another way, or new vulnerabilities might be discovered that you aren't sanitizing for before storage.