While taking the input from the form, i did sanitize the HTML code to prevent XSS attack. Eg -

<img src=X onerror=alert("XSS attack")>

The above input is converted to -

<img src=X onerror=alert("XSS attack")>

The same is sent to Database.

But while displaying it, i would like to preserve the original input given by user. So basically i would like to show as below in the form

<img src=X onerror=alert("XSS attack")>  

I tried to un-sanitize, it showed as expected but the attack happens. That is alert pop up come up "XSS attack" - pop up.