Safely handling WYSIWYG content

[XFFA.IR Bot]

What is the best practice for saving and retrieving content from the editor (wyswiyg form control) to prevent XSS attacks?

Is the recommendation to santize upon save?
XF::app()->stringFormatter()->sanitizeHtml($content);