How safe is SharePoint with Code injection (HTML,Javsscript, SQL) because for example the Announcements list allows to enter embed Code in the TextBox. Can this be a threat or SharePoint is already protected against Code injection ?. Does anyone have a sample which we can test for Code injection ?. It is very important for our Client. Thank you.
When using the object model you won't have to worry about SQL Injection as SharePoint handles that for you (it uses parameterized stored procedures internally).
And you can go to Web.config to set SafeAgainstScript stops XSS attacks via form fields.