I think you should try to identify two possible situations. One where an invalid XML leads to possible system problems (or db), and one where an invalid XML leads to possible SAP BC problems. Since I don't know this SAP BV, the latter is hard to figure out.

The first one depends on how you upload the XML data in the database. There are several post on CGI/DBI/security, fe this. And detainting this will prevent unwanted db actions (like drop table )

Since an upload of XML data is merely an upload of strings, detainting it fully depends on how the application handles the strings it reads from the database.

I hope this helps, (a little bit :-) )
---------------------------
Dr. Mark Ceulemans
Senior Consultant
IT Masters, Belgium