Let's say that there is a website which has an input field from which the input is saved to a database and then displayed somewhere else on the website.
Is it safe to only sanitize/escape the output, when the data is displayed?
Do you have to also escape the input to prevent malicious data getting into the database in the first place?
The thing that I am worried about is that even if the application handles the output by for example escaping the data from the database, but some other application may not have such mechanism to protect the users which the data is displayed to.
Is it safe to keep malicious code stored in your database for the sake of not changing the user's input as long as you can prevent it from hurting the user?