Preventing a security breach
Well, for completeness of the picture I'd like to mention that there are two places where you can sanitize user input in Pyramid - on the way in, before saving data in the database, and on the way out, before rendering the data in the template. Arguably, there's nothing wrong with storing HTML/JavaScript in the database, it's not going to bite you - as long as you ensure that everything that is rendered in your template is properly escaped. 
In fact, both Chameleon and Mako templating engines have HTML escaping turned on by default, so if you just use them "as usual", you'll never get user-entered HTML injected into your page - instead, it'll be rendered as text. Without this, sanitizing user input would be a daunting task as you'd need to check every single field in every single form user enters data into (i.e. not only "convenient" textarea widgets, but everything else too - user name, user email etc.).
So you must be doing something unusual (or using some other template library) to make Pyramid behave this way. If you provide more details on the templating library you're using and a code sample, we'll be able to find ways to fix it in a proper way.
I am creating a website where you "post", and the form content is saved in a MySql database, and upon loading the page, is retrieved, similar to facebook.  I construct all the posts and insert raw html into a template.  The thing is, as I was testing, I noticed that I could write javascript or other HTML into the form and submit it, and upon reloading, the html or JS would  treated as source code, not a post. I figured that some simple encoding would do the trick, but using <form accept-charset="utf-8"> is not working.  Is there an efficient way to prevent this type of security hole?