title: Spring MVC defaultHtmlEscape - does it work on the way in or out?
body: <p>When I set <code>defaultHtmlEscape</code> to <code>true</code> in web.xml, the values set in all input fields get escaped.</p>
  
  <p>But when they are submitted, the values are not escaped.</p>
  
  <p>So, is it true that this parameter is only for outputting, and does not include the submission of parameters (and so, if I want to store xss-safe values in the database, I should do something else)</p>