I'm not 100% sure if Kentico implements some sort of SQL Injection prevention when querying using the CMS Repeaters, but I think it does. The best way to test this is to try to inject some SQL yourself.

I do know that you need to write your queries that have macros in them in such a way that the query will not throw an error if the macro result is blank. I usually use single quotes like this '{%id%}' even if the column is an int. If you think hard enough about it, you can come up with many ways to deal with it.