Generally speaking, everything in the database should be kept as close as possible to the original version. If you need to perform any escaping, do it outside the database.
The reason for this is simple: it is only on the Internet where you must use the & sign. If you ever have a non-web interface for your database, you will have to convert these escape sequences back to the original value, which is not always possible: for example, if the user enters & (sic), if you convert it again, it will be translated to & , which will lose its original value.
source share