Best practice of handling user's input

Let's assume that I am filtering data on output not input, so it's possible that I will have in my DB as user's first name something like this?

Code:

You are hacked: <script>alert('Lorem Ipsum');</script>

Is that good way of storing data? And what is the best way of showing it when I want to have displayed user's first name somewhere?

Code:

html_escape();

Or

Code:

$this->security->xss_clean();

Combination of both?