Should HTML be encoded before being persisted?

Question

Should HTML be encoded before being stored in say, a database? Or is it normal practice to encode on its way out to the browser?

Should all my text based field lengt

Answer 1

Database vendor specific escaping on the input, html escaping on the output.