Determining when or when not to escape output

Question

I have a page, where I have approximately 90 items I need to output. Most of them are object properties (I am using ORM so these objects map to my database tables). But the question is, do I have to encode each of those 90 outputs by applying functions to each (in my case, the htmlspecialchars)? Wouldn't that add a bit of an overhead (calling a single function 90 times)?

EDIT: The term is "output encoding"...hehe

Answer 1

Someone will, at some point, enter data that can mess up your HTML page. They may do this accidentally (the company name has an ">" in it), or intentionally (see XSS).

So, yes, always properly encode output.