Question

Is this all to stop SQL injection in Drupal?

db_query('INSERT INTO {tablename} (field1, field2) VALUES ("%s", "%s")', $field1, $field2);

Answer 1

Is your question “Is this all I need to do to stop SQL injection in Drupal?”

The answer is “Almost, but not quite.”

db_query("INSERT INTO {tablename} (field1, field2) VALUES ('%s', '%s')", 
         $field1, $field2);

Single quotes are more standard for quoting values in SQL.

Alternately, if you’ve defined tablename table via hook_schema, you can use drupal_write_record instead, as the other answer states. The advantage of drupal_write_record is that you don’t have to deal with any sql, you just do this:

$tablename = array('field1' => $field1, 'field2' => $field2);
drupal_write_record('tablename', $tablename);