In what cases should I personally sanitize input & output when using the Database Abstraction Layer I'm trying to get a clearer sense of where security vulnerabilities on my site may lie. At no point in my code do I ever query the MySQL database directly; I always use the Database Abstraction Layer (db_query(), etc). Under what circumstances may this not provide sufficient protection against SQL injection attacks?

I am using Drupal 7.
If you use db_query() all the time without directly inserting variables, but using the arguments. 

For example this is right: db_query("SELECT * FROM {node} WHERE nid = :nid", array(':nid' =&gt; $nid)); it's perfect, you don't have to care about something else (except critical bug directly in Drupal).

On the other hand, if you do it directly: db_query("SELECT * FROM {node} WHERE nid = $nid"); you expose your site to SQL Injection.

From my own experience, Drupal alone (without other modules) is very secure and many times we tried to hack it with professionals.