[caustic]

Never sanitize user data before storing it in your backend. Always sanitize user data before displaying it on the screen.

[wccrawford]

I would amend that slightly:

It's okay, but mostly a waste of time, to sanitize data before storing it.

You must sanitize data when outputting it.

Why? Because someone could get the data into storage in another way, or new vulnerabilities might be discovered that you aren't sanitizing for before storage.