How to securise custom modules
It's a better idea to use db_select or other DB API functions, rather than trying to use db_query directly. You'd want to try something like:

 $to_user_balance = db_select('ubercart_funds_user_funds', 'ucfuf')
   -&gt;fields('ucfuf')
   -&gt;condition("uid", $value['in_array'], '=')
   -&gt;execute()
   -&gt;fetchAssoc();


For more, see https://api.drupal.org/api/drupal/includes%21database%21database.inc/function/db_select/7.x

And for overall DB API docs, see: Drupal.org DB API docs