Should you use check_plain() prior to inserting into database?
I downvoted Devaraj Johnson's answer because it suggests to check_plain() data before saving it to the database, which is wrong. 

The idea behind check_plain, filter_xss and filter_xss_admin is to prevent XSS attacks, which are related to the front end. 

When you handle database queries, use parameters and the DB API to prevent SQL injection attacks. Whenever you output data to the browsers, use check_plain, and other security methods. 

Note that check_plain(), filter_xss() and such functions do change the data. When you save data into the database, you are only escaping specific characters, but you do not alter the original text. If you use check_plain() in database insert/updates, saving data a few times can mess up your data with a lot of &amp;amp;, &amp;lt;, etc character replacements and some HTML tags stripped out. 

Here are some good reads:


Why Does Drupal filter on output (explains why you should not check_plain database data)
Handle text in a secure fashion