question about HTMLEditFormat()

I'm concerned about XSS attacks. I did some reading about, and have tried to implement, the  HTMLEditFormat() function.

However, when I use HTMLEditFormat() in a form input, or in a CFOUTPUT, the output on the page is the raw HTML code.

For example, if I do this:

<cfquery name="UpdatePage" datasource="#ds#">
				  UPDATE tbl_acct_navigation
				  SET
                    PageTitle = <cfqueryparam cfsqltype="cf_sql_varchar"  value="#HTMLEditFormat(form.PageTitle)#">,   
                    PageContentLeft = <cfqueryparam cfsqltype="cf_sql_varchar"  value="#HTMLEditFormat(form.PageContentLeft)#">,
                    PageContentRight = <cfqueryparam cfsqltype="cf_sql_varchar"  value="#HTMLEditFormat(form.PageContentRight)#">,
                    DateModified = <cfqueryparam cfsqltype="cf_sql_timestamp" value="#now()#">
				  WHERE PageID = <cfqueryparam cfsqltype="cf_sql_integer" value="#val(form.PageID)#">
			</cfquery>

.... then the page output displays the HTML code; the HTML is not parsed by the browser. You can see it here:

http://www.coalcountryteam.org/index.cfm?PageID=76

Where should I implement HTMLEditFormat() to add a little protection against XSS attacks?

Sorry to be asking so many questions of late. =) I really appreciate people's time.

Eric B