Regarding preventing XSS attacks, HTML encoding when user inputs? HTML encoding when outputting the page? Which solution is better?

Question

For example:
Regarding preventing XSS attacks, should HTML encoding be performed when user input? HTML encoding when outputting the page? Which solution is better?

Personally, I feel that it is more convenient to encode when inputting, because there will be more pages with output content, and it is easy to miss when encoding every time. However, in actual applications, it seems that encoding when outputting is more convenient?

Answer 1

For xss filtering, remember,
must be filtered on the server side! ! ! ! ! ! !
Be sure to filter when outputting! ! ! ! !

Answer 2

Server side: Write the escape of the library and escape when displaying

Answer 3

I usually escape when typing to prevent SQL injection