I have always found it more logic to validate input instead of filtering it. How to appropriately filter data depends on the situation, so IMO it should be done in output or when saving to a database. ...
Do you use both Client-side and Server-side validation techniques side by side when validating input from a user, e.g. via a contact form? If so, is it really necessary? Are you over engineering? ...