Should you use check_plain() prior to inserting into database? I am currently using check_plain() etc on displaying user entered data in HTML, and I am also using check_plain() etc prior to inserting the user data into my custom tables.

When inserting or updating the DB, I am always using db_insert or db_merge. Do I need to validate like I am, or are those functions doing it for me already?

If they are doing that already, do I need to use check_plain() on output still?
I downvoted Devaraj Johnson's answer because it suggests to check_plain() data before saving it to the database, which is wrong. 

The idea behind check_plain, filter_xss and filter_xss_admin is to prevent XSS attacks, which are related to the front end. 

When you handle database queries, use parameters and the DB API to prevent SQL injection attacks. Whenever you output data to the browsers, use check_plain, and other security methods. 

Note that check_plain(), filter_xss() and such functions do change the data. When you save data into the database, you are only escaping specific characters, but you do not alter the original text. If you use check_plain() in database insert/updates, saving data a few times can mess up your data with a lot of &amp;amp;, &amp;lt;, etc character replacements and some HTML tags stripped out. 

Here are some good reads:


Why Does Drupal filter on output (explains why you should not check_plain database data)
Handle text in a secure fashion