How to handle text in a secure fashion in drupal

1. Plain Text

   When outputting plain-text, you need to pass it through check_plain() before it can be put inside HTML. This will convert quotes, ampersands and angle brackets into entities, causing the string to be shown literally on screen in the browser.

  Use t() the placeholders (e.g. '%name' or '@name') are passed as plain-text and will be escaped when inserted into the translatable string. You can disable this escaping by using placeholders of the form '!name'

  Use l() as the link caption should be passed as plain-text (unless overridden with the $htmlparameter).

2.Rich Text

  This is text which is marked up in some language (HTML, Textile, etc). It is stored in the markup-specific format, and converted to HTML on output using the various filters that are enabled. This is generally the format used for multi-line text fields.

All you need to do is pass the rich text through check_markup() and you'll get HTML returned, safe for outputting. You should also allow the user to choose the input format with a format widget through filter_form() and should pass the chosen format along to check_markup().

URLs across Drupal require special handling in two ways:

1. If you wish to put any sort of dynamic data into a URL, you need to pass it through urlencode(). If you don't, characters like '#' or '?' will disrupt the normal URL semantics.urlencode() will prevent this by escaping them with %XX syntax. Note that Drupal paths (e.g. 'node/123') are passed through urlencode() as a whole since Drupal 4.7 so you don't need to urlencode individual parts of it. This convenience does not apply to other parts of the URL like GET query arguments or fragment identifiers.
2. When using user-submitted URLs in a hyperlink, you need to use check_url() rather than just check_plain(). check_url() will call check_plain(), but also perform additional XSS checks to ensure the URL is safe for clicking on.

Manually assigning content to regions

Content can be manually assigned to regions with drupal_set_content() in Drupal 6 or drupal_add_region_content() for Drupal 7. For example in Drupal 6, drupal_set_content('header', 'Welcome!') would assign the text 'Welcome!' to the header region.

Jquery Ajax call back for php

$("#btnAjax").click(function () {

  $.ajax({
    type: "GET", //GET or POST or PUT or DELETE verb
    url: 'test.php', // Location of the service
    data: "", //Data sent to server
    contentType: "", // content type sent to server
    dataType: "json", //Expected data format from server
    processdata: true, //True or False
    success: function (json) {//On Successful service call
      var result = json.name;
      $("#dvAjax").html(result);
    },
    error: ServiceFailed // When Service call fails
  });

  return false;
});