title: Should I save in db - user input as html encode?
body: <p>We're having conflict with  coworkers on whether we should <code>htmlencode</code> user input and then save it to <code>db</code> ( vs saving it straight forward as it is)</p>
  
  <p>I also found <a href="https://stackoverflow.com/a/223499/859154">various answers</a> which says that <code>DB</code> should save the plain(!) input.</p>
  
  <p>Why ? because DB should know that the user length is 1 in <code>&lt;</code> and <strong>not</strong> 4 in <code>&amp;lt;</code></p>
  
  <p>The html encoding should <strong>only</strong> be made when outputting.</p>
  
  <p><strong>but:</strong></p>
  
  <p>Having said that , I see that Stackoverflow is not following this rule.</p>
  
  <p>When I save a question here at SO , which contains plain <code>&lt;</code> it does show (obviously) the <code>&amp;lt;</code> in the preview pane. BUT when I submit the question : it submit the content as json   <strong>with html encode</strong> !</p>
  
  <p><em>Json.stringify is not doing html encode</em></p>
  
  <p>So If I type in the input : </p>
  
  <p><img src="https://i.stack.imgur.com/8dgm2.jpg" alt="enter image description here"></p>
  
  <p>And submits : </p>
  
  <p>I see (via fiddler) that it sends actually the html encode value : </p>
  
  <p><img src="https://i.stack.imgur.com/Ryd3L.jpg" alt="enter image description here"></p>
  
  <p><strong>Question :</strong> </p>
  
  <p>As you see  - i'm a bit confused. the common logic says that db should save whatever the user type 1:1.</p>
  
  <p>The sanitization should be made at the output</p>