How to use my API , But safe from sql injection?

PHP redirects can be done in WP with wp_redirect(), which basically does header("Location: $url"); after some checks on the passed argument. The problem with header redirects is they must be done before any content is output. The alternative is to use a javascript redirect, which can be executed anywhere on a page.

You can store and fetch data almost anywhere. What makes sense depends on the nature of the data. Some common locations are the options, postmeta, or usermeta tables. There’s functions to save and get data for each of these tables. You could also create your own table. You would use the global $wpdb object methods to interface with the DB in such a case.

To protect from SQL injection, see Validating Sanitizing and Escaping User Data and Data Validation.