Is necessary any sanitization functions if I use the database layer correctly In Writing secure code said:


  Use the database abstraction layer to avoid SQL injection attacks


Then, my question:

When I get value for a user form is necessary pass to check_plain() or others sanitization functions, before I use the database layer correctly.
The db abstraction layer, as you noted, should prevent SQL injection attacks.

Check_plain is actually used to make sure text is html safe. If your printing out user submitted data to the screen, it should (at some point) be run through check plain to guard against cross site scripting attacks.