Safely quoting type names to protect against SQL-injection
How would I quote the type name to protect against SQL Injection. 


You do not need format_type() for the purpose. You may have misunderstood Andrew there. All you need is the cast to regtype:

SELECT format('SELECT cast(%L AS %s);', '5.42', 'int'::regtype);


The text representation of the regtype value is the standard SQL name and quoted automatically where needed - and the value is cast to text implicitly for the concatenation. Demo:

SELECT 'varchar(20)'::regtype, 'int'::regtype, '"char"'::regtype;

regtype           | regtype | regtype
------------------+---------+---------
character varying | integer | "char"


format_type() would only serve to add type modifiers (which are lost in the cast), an orthogonal matter. Related:


PL/pgSQL regclass quoting of table named like keyword
How to introspect materialized views
PostgreSQL syntax error in parameterized query on “date $1”
Table name as a PostgreSQL function parameter