Best practices for protecting from injection on form fields
If you use the Drupal core database API functions, the content will be automatically escaped, preventing SQL injection.

You can run the content through filter_xss prior to insert, otherwise you'll need to do that on display.

Drupal core stores the content unsanitized and sanitizes it on output.

User input should be validated on input and filtered on output.

More info on sanitization functions here: http://api.drupal.org/api/drupal/includes!common.inc/group/sanitization/7

See also http://drupal.org/writing-secure-code for information on writing secure code.