No protection against sql injection

Unfortunately the plugin does not have the protection from sql injections, which is indicated by the data in the database. Tell me, what function can a hook make before data can be processed?