The default text widget - [`WP_Widget_Text`](https://core.trac.wordpress.org/browser/tags/4.0/src/wp-includes/default-widgets.php#L476) - can be found in `wp-includes/default-widgets.php`. The input is handled like this:

 - `stripslashes( wp_filter_post_kses( addslashes( $text ) ) );` for the text;

I assume this should work likewise for your custom widget. Additionally there is:

 - `wpautop( $text )` on the output, if the filter is set to do that;

But optimally you're taking a look at the source yourself. 

Additionally the codex articles:

 - [Validating Sanitizing and Escaping User Data](http://codex.wordpress.org/Validating_Sanitizing_and_Escaping_User_Data); and  
 - [Data Validation](http://codex.wordpress.org/Data_Validation)

give you an good overview about sanitizing, escaping and validating possibilities with WP.