What's the best way to prevent HTML/Script injections into TextBox'es?

Hi,
I usually use HttpUtility.HtmlEncode and HttpUtility.HtmlDecode for this but my fear is that someone injects some nasty javascript, I encode it before committing it to the database so it doesn't harm me but the next person who pulls up the page, gets the javascript because I decode the HTML before rendering the page.
What's the best way to handle this in public facing websites?
...