what kind of sanitization needs to be done when doing civicrm_api3('Contact', 'create') inside custom drupal modules?
The Drupal Webform module sanitises form inputs.

The Webform CiviCRM Integration module uses the underlying webform submission functions to sanitise data.

However the accepted answer on this question makes a very valid point.


  It's a common misconception that user input can be filtered. PHP even has a >(now deprecated) "feature", called magic-quotes, that builds on this idea. It's nonsense. Forget about filtering (Or cleaning, or whatever people call it).
  What you should do, to avoid problems, is quite simple: whenever you embed a string within foreign code, you must escape it, according to the rules of that language.


Both modules mentioned above are covered by the Drupal security advisory policy.