You won't need to worry about sql injection attacks if you use the quote() ( or q()) and quoteName() (or qn()) methods appropriately.
Secure on search
Special attention should be paid to LIKE clauses
which contain the % wildcard character as these require special
escaping in ...
You can not do it like this, because that's responsibility of another component and not of the user Model/Class.
Use something like:
JLoader::register('FieldsHelper', JPATH_ADMINISTRATOR . '/components/com_fields/helpers/fields.php');
$fields = FieldsHelper::getFields('com_users.user', $user, true);
$prop = ...
Because it is in a module it will not understand the context.
Usually the fields are called by checking the article id from the menu item, but as it is a module, it does not have a menu item or an article id.
So you need to find the article ID for each particular article. Then call it that way.
Here you can find out how to get the fields renderer to work: