server.htmlencode sql injection

[Cullen411]

should I use both server.htmlencode and an SQL injection protection function for every text field and textarea that a visitor can enter info into?
An example would be a user registration form

 

[Tarwn]

I'm not sure it would be necessary to use HTMLEncode, it would depend on what you plan to do with the text I'd guess.
Definately do SQL injection protection on all your form fields before using them in a SQL statement. Any form value could be spoofed. So make sure you validate lengths and such as well, besides escaping special characters.