When to use the XSS filter?

In the security part of the documentation, it says

XSS filtering should only be performed on output. Filtering input data may modify the data in undesirable ways, including stripping special characters from passwords, which reduces security instead of improving it.

That part links to the documentation for the security class, which says

Note: This function should only be used to deal with data upon submission. It’s not something that should be used for general runtime processing since it requires a fair amount of processing overhead.

What should I do?