fck is sure against sql injection?

It can't be protected against SQL because it doesn't use any DB. It's up to you to do it just the same way that you would protect data from a textarea.
Also it also doesn't check against malicious html so you better check who do you allow to use the editor and properly check that they have inserted only valid html (and the meaning of valid depends on you)