php - Escape values into database or after -

what right way escaping?

i have basic registration form, username , password eg. save these value database via php script (everything in php) using pdo no sql injection should possible (i hope, if theres safer way it, tell me please). question is, should escape username value before saving database. if try do

<script>alert("hi")</script> 

it save

<script>alert("hi")</script> 

in database. , after no xss should possible (yeah kinda naive statement dont know how else this). or save plain text

<script>alert("hi")</script> 

into database , @ time want print values somewhere escape them?

in opinion safer way escape on save database event, put escaped values database , print them. there guess problem, should again use escape function on escaped values in database whenever want print them? or print them (should escaped). first "solution" dont because

<script>alert("hi")</script> 

will rendered in browser escaped not safe chars < , second solution seems if mess once i'm doomed.

rule of thumb: if user able edit input later, save in db unescaped.

otherwise escape before writing db save processing step on every output.