All strings that come from [user input] must be stored in variables (or database columns) with a name starting with the prefix "us" (for Unsafe String). All strings that have been HTML encoded or which came from a known-safe location must be stored in variables with a name starting with the prefix "s" (for Safe string).
us = Request("name")
...pages later...
usName = us
...pages later...
recordset("usName") = usName
...days later...
sName = Encode(recordset("usName"))
...pages or even months later...
Write sName
The thing I want you to notice about the new convention is that now, if you make a mistake with an unsafe string, you can always see it on some single line of code, as long as the coding convention is adhered to: s = Request("name")
is a priori wrong, because you see the result of Request being assigned to a variable whose name begins with s, which is against the rules.[1] http://www.joelonsoftware.com/articles/Wrong.html
(edit: formatting, citation)