Drupal form_state sanitization
The values in $form_state['values'] are all sanitized.

The values in $form_state['input'] are the raw unsanitized form values.

$form_state['storage'] is usually only used on multistep forms to keep data for other form steps.

Where possible always use the values from $form_state['values'].

See this post for more information: Avoid using data from $form_state['input']

To quote that linked article:


  The Form API's drupal_validate_form() and _form_validate() functions
  take care of populating a safe set of data in $form_state['values'],
  using sanitized data from $form_state['input'].