 <p>Neither.</p> <p>Protect your database from SQL injection <em>when making queries</em>. Where possible, do it <a href="http://stackoverflow.com/a/60496/19068">with parameterized queries</a> instead of manual escaping. </p> <p>Protect your HTML from XSS <em>when you generate your HTML</em>. i.e. apply <code>htmlspecialchars</code> to the data you get <em>out</em> of the database, not the data you put into it.</p>