how to show data in textview from sqlite database in android?

For my web application, if I want to make sure the user data is not harmful, which approach is generally preferred:  should I encode all the data saved in the database, html encode everything from the database that I show on the page or both?

• I heard people saying that once you sanitize your data to prevent sql injection, you should save it into the database as is and only deal with escaping it when you present it to the user.  How valid is this statement?

• Answer:

  To prevent SQL injection, properly escape data that you include in SQL statements, ideally using a prepared statement interface that does this for you. Note that this layer of encoding is aimed to make the data safe for the SQL parser and adds no escaping to the stored data itself. You would normally HTML encode data from the database when presented to the user, to prevent "markup injection". Storing HTML encoded data might be justifiable depending on your application.