Safe string checkup against user-supplied suffix/prefix strings
Treat it like any other user input; that is, not to be trusted. Do you have a reason to allow HTML tags in the prefix/suffix? If not, output only after running through check_plain(). filter_xss() is quite permissive in its allowed tags so just be sure you're OK with that before using. See also the drupal.org documentation on handling text in a secure way.