Jon (Kenshino) on "Does update_post_meta() use sql prepared statements?"

What you should do is to sanitise the field using wp_kses. (Allows you to define the allowed html tags)

If you want to allow the standard tags that the WP Editor (TinyMCE) accepts, you can use wp_kses_post