Drupal 6 & Custom query sanitization
The Drupal 6 version of db_query supports placeholders.  The best explantion of these is probably the Writing secure code article.

A (contrived) example would be 

$query = "
  SELECT node.nid FROM {node} node
  INNER JOIN {content_type_foo} content_type_foo ON content_type_foo.nid = node.nid
  WHERE content_type_foo.field_foo_value = '%s'
";

$foo = $_GET["foo"];    
$nid = db_result(db_query($query, $foo));


The referenced article also shows how to use placeholder arrays for handling a variable number of arguments, like for WHERE IN queries.

The second edition of Pro Drupal Development, which covers Drupal 6, is also a good reference for using the database abstraction later.