[bsamuels]

In addition to "never trust user input";

Never trust your program's output

You should have two sets of sanitization, one that sanitizes incoming data, and one that sanitizes outgoing data.

[billmalarky]

I disagree. Obviously data should be validated. But passing validation, I prefer to store data exactly as the user supplied it and then sanitize on output. That way you always have a copy of the original data assuming things change.

[dspillett]

Definitely. If it is genuinely invalid, refuse it, otherwise store everything as-is. You don't know on the way in what encoding will be needed on the way out: the same sting could be output later plain, in HTML, in a JS literal, in SQL if someone is daft enough to use ad-hoc unparamerterised queries, and so forth.