I downvoted Devaraj Johnson's answer because it suggests to
check_plain() data before saving it to the database, which is wrong.
The idea behind
filter_xss_admin is to prevent XSS attacks, which are related to the front end.
When you handle database queries, use parameters and the DB API to prevent SQL injection attacks. Whenever you output data to the browsers, use check_plain, and other security methods.
filter_xss() and such functions do change the data. When you save data into the database, you are only escaping specific characters, but you do not alter the original text. If you use
check_plain() in database insert/updates, saving data a few times can mess up your data with a lot of
<, etc character replacements and some HTML tags stripped out.
Here are some good reads: