xss attack prevention

I have a few important things that I am still quite confused regarding storing special characters in database. Let's say there is a textbox for typing on our form(screen) for typing in "comments".
I would like the user to be able to type pretty much anyhing while keeping the application safe.
1. Do I need to do HtmlEncode before I write a record into the database. In that case O'Brian will look like O'Brian in database table.
And will I need to write a function to convert it back to O'Brian when I write the data back on the the form ?

2. Save the data as it is (as O'Brian in table) and do the htmlencode while displaying data to prevent running scripts and things....?

3. or if there is any other way to store the data safely to prevent sql injection and xss attacks.

Thanks much.
...