Can I use server htmlEncode to protect against XSS?

 Using classic ASP, is this the right way to protect against XSS?

var1=untrusted user input
Showing a text in the body
<%=server.htmlencode(var1)%>
Showing a link in the body
Showing an image
" >"><>< style="font-size:11pt;font-family:Arial;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Showing an iframe
<iframe src="http://www.example.com/page.asp?var1=<%=server.urlencode(var1)%>"></iframe>
In meta tags
<meta name="description" content="<%=server.htmlencode(var1)%>">
In forms
<input type="text" name="var1" value="<%=server.htmlencode(var1)%>">
In email