Quick question about filter_xss()
Sanitization functions, which include filter_xss(), are used when a value is shown as output, not when something is saved in the database.

None of those functions is called when saving a node in the database.

See Writing secure code.


  Use check functions on output to prevent cross site scripting attacks
  
  No piece of user-submitted content should ever be placed as-is into HTML.
  
  
  Use check_plain() or theme('placeholder') for plain text.
  Use check_markup() or filter_xss() for markup containing text.
  Use the t() function with @ or % placeholders to construct safe, translatable strings.