Also really it should be less about sanitising, more about escaping. If possible, the input should be stored essentially as-is.