The database couldn't care less about HTML tags, entities, and so forth. All you need to do is protect against SQL injection and parse errors by using the applicable escaping function or prepared statements for the database interface being used (e.g. [man]mysql_real_escape_string[/man] for the basic MySQL extension).
When you retrieve the data from the database and output it, then is the time to apply any output filtering for the target client, such as htmlspecialchars() or htmlentities() if outputting XML or HTML.
