is $wpdb->get_results() safe enough

You have to always use $wpdb->prepare() before $wpdb->query() or $wpdb->get_results() if your queries depend on dynamic variables