[Dismounted]

Yes I did notice that, and you also specified TYPE_STR. This, however, does nothing for SQL injection, it merely verifies that it is a string. You need to escape dangerous characters (such as single quotes).

PHP Code:

$db->query_write("
    INSERT INTO " . TABLE_PREFIX . "$testtable
    (testcolumn)
    VALUES
    (" . $db->escape_string($vbulletin->GPC['testform']) . ")
");