title: Which of the following ways works better to prevent XSS attacks?
body: <p>I am implementing input encoding to prevent XSS attacks and I have few questions.</p>
  
  <ol>
  <li><p>Is it better to encode inputs and store the encoded data in the database? If so, how do you deal with string comparison in the whole project? Do you encode the string to compare as well? It seems like a "not so good" approach, because I'd have to adjust the whole project and future programmers have to remember this every time they compare two strings.</p></li>
  <li><p>Should I throw the inputs directly into the database and encode them in response? This seems like a better way, but I'm not really sure. That's why I post here. Also, if this is the preferred way, is there any database management application (like phpMyAdmin etc.) that executes JavaScript directly from the database?</p></li>
  </ol>
  
  <p>This is the first time I'm doing it, so I'd love some insight from more experienced developers.</p>