You need to be a little more specific. If you are writing the query to insert the data, it is your job to sanitize all the variables before doing so.

All strings must be escaped with $vbulletin->_db->escape_string() [I think that is the function name IIRC]. Before doing that though, you need to use vBulletin's input cleaner to sanitize the vars:

See Create Secure Mods article for more info.