<p>When do you call <code>Microsoft.Security.Application.AntiXss.HtmlEncode</code>?  Do you do it when the user submits the information or do you do when you're displaying the information?  </p>

<p>How about for basic stuff like First Name, Last Name, City, State, Zip?</p>

You should only encode or escape your data at the last possible moment, whether that's directly before you put it in the database, or display it on the screen. If you encode too soon, you run the risk of accidentally double encoding (you'll often see
```
&amp;amp;
```
on newbies' websites - myself included).
If you do want to encode sooner than that, then take measures to avoid the double encoding. Joel wrote an article about good uses for hungarian notation, where he advocated use of prefixes to determine what is stored in the variable. eg: "us" for unsafe string, "ss" for safe string.
```
```
usFirstName = getUserInput('firstName')

ssFirstName = cleanString(usFirstName);
```
```
Also note that it doesn't matter what the type of information is (city, zip code, etc) - leaving any of these unchecked is asking for trouble.