How to secure our form entries in Drupal?

User-submitted data in Drupal can be divided into three categories:

1. Plain-text
2. Rich text
3. Admin-only HTML

No piece of user-submitted content should ever be placed as-is into HTML.

    * Use check_plain or theme('placeholder') for plain text.
    * Use check_markup or filter_xss for markup containing text.
    * Use the t() function with @ or % placeholders to construct safe, translatable strings.

Refer: http://drupal.org/node/28984