Best practices for protecting from injection on form fields I am building a form in Drupal 7. I have a textarea field and would like to know if it is safe to get the field content ($form['values']['field_name']) and save it to the database using something like db_insert, db_update or db_merge. OR do I have to do some sort of filtering to avoid SQL injection attacks. Thank you
If you use the Drupal core database API functions, the content will be automatically escaped, preventing SQL injection.

You can run the content through filter_xss prior to insert, otherwise you'll need to do that on display.

Drupal core stores the content unsanitized and sanitizes it on output.

User input should be validated on input and filtered on output.

More info on sanitization functions here: http://api.drupal.org/api/drupal/includes!common.inc/group/sanitization/7

See also http://drupal.org/writing-secure-code for information on writing secure code.