(Readers should note that this question is a follow-up to advice given in this thread.)

You're on the right track about encoding entities, but you're getting off at the wrong station.

The time to encode entities is as you're generating HTML after you've pulled data out of the database. If you encode them before inserting them into the database, your data gets polluted, and is harder to use for other purposes. (E.g., if you use a report writer, you'll have ugly little HTML entities in your report text.

Once you've pulled data out of the database, you can use HTML::Entities to encode special characters.