How do protect myself when a user inputs text?

Is there a standard procedure for handeling text inputs? What I have done so far is save the string into a variable and then look for script and meta tags. After that i put the text into a Parameter to protect me against sql-injections and then I insert it to the database. Is this a good way? What is the "correct way" of staying protected against all threats out there? When possible, I also HTML.Encode the text when I retrieve it from the database to cancel out hyperlinks etc.

Dim text As String = textbox1.Text If text.ToLower.Contains("<script") Or text.ToLower.Contains("<meta") Then Exit Sub End If


...