MathGolf, 7 bytes

·n\ ]yñ

Try it online.

Explanation:

·        # Quadruplicate the (implicit) input-character
 n       # Push a newline character "\n"
  \      # Swap the top two items
         # Push a space character " "
    ]y   # Wrap all values on the stack into a list, and join them to a string
      ñ  # Palidromize this string
         # (after which the result is output implicitly)

Japt -R, 11 9 8 bytes

³³h4S ò3

Try it

³³h4S ò3     :Implicit input of string
³³           :Repeat 9 times
  h4         :Replace the character at 0-based index 4 with
    S        :  Space
      ò3     :Partitions of length 3
             :Implicit output, joined with newlines

AWK, 24 bytes

sub(/./,"&&&\n& &\n&&&")

Attempt This Online! or try some more test cases.

This is one byte shorter than $0=$0$0$0RS$0FS$0RS$0$0$0.

This is basically regex substitution that takes one char and puts it into the box shape. sub without the 3rd argument takes and modifies $0 in-place. Since the substitution always succeeds, the sub call evaluates to true and the modified $0 is printed (the default action).

sub($0,...) doesn't work because some chars don't form a valid regex, such as [.

Gema, 22 characters

*=*$0$0\n$0 $0\n$0$0$0

(Frustratingly inefficient. In Gema the * (and ?) have order numbers, so in ***=*** each * on right side matches the * on left side with same order number. ☹)

Sample run:

bash-5.2$ echo -n 'M' | gema '*=*$0$0\n$0 $0\n$0$0$0'
MMM
M M
MMM

Try it online!

Vyxal j, 40 bits^v2, 5 bytes

4*ð+∞²

Try it Online!

Bitstring:

0100101010111010101000100000000000001010

optimal encoding for a 6 byter

MATL, 8 bytes

4Y"0yv3e

Unlike my other MATL answer, this builds the output manually, without using any predefined literal.

Try it at MATL Online!

Explanation

Consider input '^' as an example.

      % Implicitly input one char.
4Y"   % Repeat 4 times. Gives a string.     STACK: '^^^^'
0     % Push 0. Char 0 is shown as space.   STACK: '^^^^', 0 
y     % Duplicate from below.               STACK: '^^^^', 0, '^^^^'
v     % Concatenate everything vertically.  STACK: ['^';'^';'^';'^';0'^';'^';'^';'^';'^']
3e    % Reshape into a 3-row char matrix.   STACK: ['^^^';'^ ^';'^^^']
      % Implicitly display.

K (ngn/k), 34 bytes

{`0:x,x,x,"\n",x," ",x,"\n",x,x,x}

Try it online!

The straightforward (although long) answer.

Vyxal, 7 bytes

D¶?ðWṅ∞

Try it Online!

Using the canvas builtin is the same byte count:

Vyxal, 7 bytes

3»«₁»ø∧

Try it Online!

APL (Dyalog Extended), 15 bytes

(' ',⍞)[⊤7 5 7]

Try it online!

Indexes into a binary matrix.

Requires ⎕IO←0(0-indexing)

MAWP, 29 bytes

|!;!;!;25W;!;84W;!;25W;!;!;;.

Try it!

-6 bytes from Dion's straightformard solution.

MAWP, 35 bytes

%|7[1A~!~]////25W//84W//25W////~[;]

Manually shifting the stack was more practical than trying to loop through it and make a box.

Try it!

Poetic, 208 bytes

BOX,OR SQUARE
i was creating a side,i built a box
i looked,it was four-sided
i am somewhat weirdly earnest,however,about n*n squares having a"no-holes-in-a-drawing"shape
i am trying to produce regular squares

Try it online!

StupidStackLanguage, 28 bytes

jfffavvflflqvvvviifblflflfff

Try it online!

Explanation

j # Get the input (x)
fff # first 3
avv # new line
fl # print new line
fl # first x
qvvvviifb # space
lf # second x
lf # new line
lfff # last 3 x's

1+, 40 38 bytes

,";";";(|11+""*")++";^";()**;";^;";";;

Longer than I thought. Ungolfed, but it's a start.

J, ¹² 9 bytes

3 3$4j1#]

Try it online!

-3 thanks to FrownyFrog

W d n, 8 bytes

º±▀σ\g┘╒

Uncompressed:

4*:' S++3,

Explanation:

4*         Repeat input 4 times
  :' S++   Put space in middle, append input * 4
        3, Chop into 3 equal pieces
Flag: n Join with newlines

W d, 13 11 9 bytes

Here's a version without chopping or similar built-ins.

↨i`♣T'@└µ

Explanation

Uncompressed is:

' a++bab++E

          E % Foreach in the string:
' a++       % (implicit) input, the space, and input
     bab++  % Output the string created by the input,
            % the current item, and the input
            % With a newline
            % The None isn't outputted

AWK, 28 26 25 bytes

$0=$0$0$0RS$0FS$0RS$0$0$0

Try it online!

Husk, 6 bytes

Husk is way easier to use than Pyth.

C3w½*8

Try it online!

Explanation

    *8 Repeat the input 8 times. "!" -> "!!!!!!!!"
   ½   Halve the input. "!!!!!!!!" -> ["!!!!","!!!!"]
  w    Join with spaces. ["!!!!","!!!!"] -> "!!!! !!!!"
C3     Split into chunks of 3. ["!!!","! !","!!!"]

Husk automatically outputs lists joined with newlines

GolfScript, 13 bytes

4*.' '\++3/n*

Try it online!

Explanation

              # input #
4*            # ["####"]
  .           # ["####","####"]
   ' '        # ["####","####"," "]
      \       # ["####"," ","####"]
       ++     # ["#### ####"]
         3/   # [["###" "# #" "###"]]
           n* # [["###\n# #\n###"]]

TI-BASIC, 14 + 6 = 20 bytes

This submission uses two programs, the main one and a helper program called prgmΘ.

prgmΘ:Disp Ans+" "+Ans:prgmΘ         ;main program

Disp Ans+Ans+Ans                     ;helper program "prgmΘ"

Input is a string stored in Ans.

GolfScript, 15 bytes

...n\." "\.n\..

Explanation

At the beginning of the program, the input is put onto the stack. Each . copies the top of stack. Each n pushes a newline onto the stack. " " pushes a space. \ swaps the top two elements. At the end of the program, the stack is output to the standard output.

Try it Online

Burlesque, 20 bytes

3.*3.*{1 1}' D!)\[un

Try it online!

3.*       # Make a list of 3 instances     {A A A}
3.*       # Again                          {{A A A} {A A A} {A A A}}
{1 1}' D! # Set value at 1,1 to a space    {{A A A} {A   A} {A A A}}
)\[       # Concatenate each internal list {"AAA" "A A" "AAA"}
un        # Join array with newlines

Burlesque, 23 bytes

495b2"1"x/r~'0' r~3coun

Try it online!

Just for a bit of variety

495b2   # Read the number 495 as binary (111101111)
"1"x/r~ # Replace 1s with input char
'0' r~  # Replace 0 with space
3co     # Chunks of 3
un      # Separate by newlines

Python 3, 31 bytes

lambda s:3*s+f'\n{s} {s}\n'+3*s

Try it online!

naz, 46 bytes

1x1f0m9a1a1o0x1r2x1v3o1f1v1o0m4a8m1o1v1o1f1v3o

Strictly speaking, the above program outputs the exact byte stream required to make the square, though the top of the square will be misaligned given that the interpreter linked above always prepends output: to program output.

Explanation (with 0x commands removed)

1x1f0m9a1a1o     # Function 1
                 # Reset the register, add 10 and output (produces a newline)
1r2x1v           # Read the first byte of input and store it in variable 1
3o               # Output the byte 3 times
1f               # Call function 1
1v1o0m4a8m1o1v1o # Output variable 1, output 32 (space), then output variable 1
1f               # Call function 1
1v3o             # Output variable 1 3 times

05AB1E, 7 6 bytes using the canvas and compressed integers.

3IŽ9¦Λ

Try it online!

Keg, 11 bytes

???
? ? 
???

It really just replaces the ?s with the input!

Alterate 11 byter

¿3*:&
? ?
&

Acc!!, 58 bytes

N
Count i while 11-i {
Write _+i%4/3*(10-_)+i%6/5*(32-_)
}

Try it online!

How?

Let's lay out the desired output in a line, substituting _ for the newlines, and look at patterns and indices.

###_# #_###
01234567890

We need newlines at indices 3 and 7, a space at index 5, and the input character at all other indices. To put it a different way, for index i, we want newline when i%4 == 3, space when i%6 == 5*, and the input character otherwise.

So, after reading the input character into the accumulator with N, we run a Count loop from 0 up to but not including 11. Iff i%4 is 3, i%4/3 is 1, and we output _+(10-_) i.e. 10 i.e. newline. Iff i%6 is 5, i%6/5 is 1, and we output _+(32-_) i.e. 32 i.e. space. Otherwise, we output _ i.e. the accumulator value i.e. the input character. Fortunately, the two modulo cases are never true at the same time; this would happen at index 11, but we stop at index 10.

* The modulo operation would seem unnecessary here, but (as far as I can tell) it is the shortest way to test i == 5 in Acc!!, which doesn't have a comparison operator.

Dart, 30 bytes

f(s)=>'$s$s$s\n$s $s\n$s$s$s';

Try it online!

Emacs, 15 keystrokes

The current buffer must only contain the input character, and the cursor must be at the start of the line.

C-k C-y C-y C-y C-a C-k C-y RET C-y C-b BACKSPACE SPC C-e RET C-y

UGL, 23 Bytes

j"\n"++l*I3l++i" "il*i3

try it online (write the code to stdin. you can also use the link at the top of the answer to try online, that accepts ctrl+v)

Equivalent Python code:

cur_inp = ""
def inp():
    global cur_inp
    cur_inp = input()
    return cur_inp
"\n".join([inp*3]+[cur_inp+" "+cur_inp]+[cur_inp*3])

Using Python's string multiplication.

Pepe, 54 bytes

REEeREEEeeReeerREeeeeEeEeReeereeeEeeeeeReeeREEeeReReee

Try it

Explanation:

REEe        # Input as str
REEEee      # Duplicate it
Reee        # Output whole stack
rREeeeeEeEe # Insert linefeed (10) to the stack
Reee        # Output whole stack
reeeEeeeee  # Print space (' ')
Reee        # Output whole stack
REEee       # Go to next position
ReReee      # Pop it (space) and output the whole stack

K (oK), 8 bytes

Solution:

3 3#5$4#

Try it online!

Example:

> 3 3#5$4#"@"
("@@@"
 "@ @"
 "@@@")

Explanation:

Evaluated right-to-left. Build 'AAAA', then 'AAAA ' and then shape into the 3x3 grid required.

3 3#5$4# / the solution
      4# / take 4 of whatever is to the right
    5$   / right pad with whitespace to length 5
3 3#     / shape into 3x3 grid

Bonus:

The solution is a polyglot for q/kdb+:

q)3 3#5$4#"*"
"***"
"* *"
"***"

Syms, 21 bytes

{}<[[[++~[{& &}~[>~>>

Try it online!

Excel VBA, 27 Bytes

Anonymous VBE immediate window function that takes input from cell [A1] on the Application.ActiveSheet object and outputs a 'square' to the VBE immediate window.

a=[A1]:?a;a;a:?a" "a:?a;a;a

Python 2, 34 bytes

lambda n:3*n+'\n'+n+" "+n+'\n'+3*n

Try it online!

Perl 5, 23 + 1 (-p) = 24 bytes

The brute force way seems to be the shortest.

$_.="$_$_
$_ $_
$_$_$_"

Try it online!

Windows batch, 37 bytes

@echo %1%1%1
@echo %1 %1
@echo %1%1%1

Simply outputs the first command-line argument in a square form.

Pyth, 11 bytes

jc++K*z4dK3

Try it online!

Explanation:

jc++K*z4dK3    expects a single char as input

j              joins on new line
 c        3    chops array into 3 sized pieces
  +            joins +K*z4d and K
   +           joins K*z4 and d
    K          initialize variable K as *z4
     *z4       duplicate the input 4 times
        d      variable initialized to string " "
         K     calls variable K, in this case *z4

05AB1E, 7 6 bytes

-1 byte thanks to carusocomputing.

ж¹ðJû

Explanation:

         # Implicit input                  # ['R']
 Ð       # Repeat string three times       # ['R', 'R', 'R']
  ¶      # Push newline character          # ['R', 'R', 'R', '\n']
   ¹     # Push first input                # ['R', 'R', 'R', '\n', 'R']
    ð    # Push space                      # ['R', 'R', 'R', '\n', 'R', ' ']
     J   # Join stack                      # ['RRR\nR ']
      û  # Palindromize ("abc" -> "abcba") # ['RRR\nR R\nRRR']
         # Implicit output                 # []

Uses the CP-1252 encoding. Try it online!

CJam, 11 10 bytes

r9*4St3/N*

Try it online!

Explanation:

r9*4St3/N* e# Expects single char (token) as input
r          e# Get input token (C)
 9*        e# Repeat C 9 times
   4St     e# Set the 5th char of C to be a space
      3/   e# Split into parts of length 3
        N* e# Join by newlines

brainfuck, 48 bytes

Great simple challenge.

,...>++++++++++.<.>+[->+>+++<<]>>-.<<<.>>-.<<...

Try it online!

Explanation

,...              : take input, print it 3 times
>++++++++++.      : print ASCII with index 10 (new line)
<.>               : print input.
+[->+>+++<<]>>-.  : add 1 to 10, triple it, subtract one and print it (space)
<<<.>>-.<<...     : print input, newline, and input 3 times

J-uby, 22 20 bytes

-2 bytes thanks to @Jordan

:tr&"...
. .
..."&?.

Explanation

String#tr is Ruby's character-wise replace method. The first & binds :tr to "...\n. .\n...", and the second partially applies '.' to it. Effectively, this is ->s{"...\n. .\n...".tr('.',s)}

Z80 or 8080 Assembly, 21 bytes machine code

Assume a memory mapped I/O device:

              Z80                  8080
3A xx xx    ld  a, (input)      lda  input       ; get input character
11 0A 20    ld  de, 200ah       lxi  d, 200ah   ; space & newline
21 yy yy    ld  hl, output      lxi  h, output  ; get output address
77          ld  (hl), a         mov  m, a       ; output character * 3
77          ld  (hl), a         mov  m, a
77          ld  (hl), a         mov  m, a
73          ld  (hl), e         mov  m, e       ; output newline
77          ld  (hl), a         mov  m, a       ; output character
72          ld  (hl), d         mov  m, d       ; output space
77          ld  (hl), a         mov  m, a       ; output character
73          ld  (hl), e         mov  m, e       ; output newline
77          ld  (hl), a         mov  m, a       ; output character * 3
77          ld  (hl), a         mov  m, a
77          ld  (hl), a         mov  m, a
76          halt                hlt             ; or C9 ret

No interpreter needed!

Hexdump:

0000: 3A 00 FF 11 0A 20 21 01 FF 77 77 77 73 77 72 77
0010: 73 77 77 77 76

where the input address is at FF00h and the output address is mapped at FF01h. The actual addresses will depend on the actual hardware. Of course this assumes the I/O is memory mapped. If it is I/O mapped, it would take several extra bytes because Z80 & 8080 I/O instructions are two bytes each. This also assumes the output device interprets 0Ah as a newline and doesn't require a CR (0Dh) which would add an extra 4 bytes to the program.

R, 44 bytes

cat(y<-rep(scan(,''),4),' ',y,sep='',fill=3)

Test and output:

> cat(y<-rep(scan(,''),4),' ',y,sep='',fill=3)
1: #
2: 
Read 1 item
###
# #
###
> 

OCaml, 53 bytes

let f c=String.map(function '#'->c|c->c)"###
# #
###"

It's pretty bad. OCaml does not even have a replace function

Bash, 26 bytes

echo "$1$1$1
$1 $1
$1$1$1"

5 bytes less boring

Haskell, 45 44 bytes

-1 byte thanks to Laikoni

Naive approach

f s=putStrLn$s:s:s:'\n':s:' ':s:'\n':s:s:[s]

For some reason

f s=putStr$s:s:s:'\n':s:' ':s:'\n':s:s:[s]

won't output the last line on repl.it, but if it's still valid it shaves off 2 bits for a total of 42

And

f s=print$s:s:s:'\n':s:' ':s:'\n':s:s:[s]

will print the answer as "sss\ns s\nsss" instead of properly linebreaking. If that's valid it shaves off 3 bits for a total of 41

There is a solution with replace that's 42 bits long ... but that's without counting the bytes needed to import the necessary module. For reference:

import Data.String.Utils
f s=putStrLn$replace "." s "...\n. .\n..."

Ruby, 23+1 = 24 bytes

Uses the -n flag for +1 byte.

puts$_*3,$_+' '+$_,$_*3

Try it online!

Cubix, 26 bytes

./v.o;@?/i:::Ns:Ss:Nu/:::s

This is the first piece of Cubix code I've ever written...I was originally going to try to answer the Try to make a cube challenge, but I figured I'd answer the original (easier) question first. Cubix is pretty cool!

Try it online! and also Watch the interpeter!

R, 43 40 bytes

cat(gsub("y",scan(,""),"yyy\ny y\nyyy"))

Saved 3 bytes thanks to Giuseppe.

Explanation: create a box using the character "y" and then substitute the input character.

braingasm, 18 bytes

,...10..32..10....

Yeah... read a byte, print it three times, then print a newline (10), then the byte again, then a space (32), that byte again, another newline and that byte three more times...

PowerShell, 26 Bytes

param($c)$c*3;"$c $c";$c*3

takes a char/length 1 string - then prints it 3 times, it twice with a separating space, and it 3 times again.

Javascript (ES6), 32 bytes

i=>`###
# #
###`.replace(/#/g,i)

Sinclair ZX80/ZX81 (without sanity check), ~55 Bytes (listing)

 1 INPUT A$
 2 PRINT A$;A$;A$
 3 PRINT A$;" ";A$
 4 PRINT A$;A$;A$

With sanity check (ZX80 with 8K ROM or ZX81)

 1 INPUT A$
 2 IF NOT LEN A$ OR LEN A$>1 THEN GOTO 1
 3 PRINT A$;A$;A$
 4 PRINT A$;" ";A$
 5 PRINT A$;A$;A$

Line two of the latter version makes sure that there is a single character entered. So in the first example, it is possible to enter nothing and simply press NEW LINE.

Swift, 54 bytes

var s=readLine()!,a=s+s+s+"\n";print(a+s+" "+s+"\n"+a)

QBIC, 23 20 bytes

Brute-forcing this is shorter than fancy string-flips...

?;+A+A?A+@ `+A?A+A+A

Original answer:

A=;+A+A+@┘`+A?A+@ `+_fA

Explanation:

A=;     ; gets a cmd line parameter and assigns it to A$
        This overrides that value by
  +A+A    appending itself two times
  +@┘`    Then a literal newline
  +A      And another copy of the input char
?       PRINT
  A       The combined A$ ("###\n#")
  +@ `    a space
  +_fA    and then the flipped version of A$

Vim, 9 keystrokes

Assuming the input char is present in a buffer, vim makes this straightforward

x3pY2plr<space>

There is probably some magic vim commands of use here (there always seem to be some) so improvement suggestions are welcome. Only one keystroke behind V!

Python 3.6, 33 bytes

lambda c:f'{3*c}\n{c} {c}\n{3*c}'

Try it online!

///, 27 bytes

/\\\#//\#\#\#
\#\ \#
\#\#\#

Try it online!

Since there is no other way to take input in ///, it is hard-coded.

/\\\#/INPUT HERE/\#\#\#
\#\ \#
\#\#\#

Version that takes input in Itflabtijtslwi (28 bytes):

GG\\\#GG\#\#\#
\#\ \#
\#\#\#

Try it online!

Common Lisp, SBCL, 50 bytes

(format t"~@?
~a ~:*~a
~@*~@?""~3@{~a~:*~}"(read))

Explanation

format              ;printing function
~@?                 ;execute format string given as argument
~a ~:*~a            ;print current argument (will be result of (read))
                    ;then print space, go back one argument (to again use 
                    ;result of (read) and print it  
~@*~@?              ;go back to first argument, then execute format string 
                    ;given as this argument
"~3@{~a~:*~}"       ;loop three times printing argument number 2 
                    ;~:* makes it keep going back to argument number 2
(read)              ;take input

Ideas for improvement are welcomed.

Brainfuck, 40 bytes

+++++[->++<<++++++>],...>.<.<++.>.>.<...

Try it online! Requires an implementation that can access left of the starting position.

Also see: Graviton's brainfuck answer which takes a different approach (but is longer).

Explanation:

Brainfuck can do a lot of cool tricks with its limited instruction set. Unfortunately, this answer doesn't use any of them, because it's cheaper (in terms of bytes) to just hardcode everything.

+++++[->++<<++++++>]                         Sets the cells to |5*6|>0<|5*2|
,                   Takes input character into the middle cell | 30|>#<| 10|
...                                Print the top of the square | 30|>#<| 10| ###
>.                                   Print a newline character | 30| # |>10|    \n
<.                               Print another input character | 30|>#<| 10| #
<++.                  Add 30+2 for a space character and print |>32| # | 10|  _
>.                   And just print the 5 remaining characters | 32|>#<| 10|   #
>.                                                             | 32| # |>10|    \n
<...                                                           | 32|>#<| 10| ###

# = input character, _ = space (ASCII 32), \n = newline (ASCII 10)

Results in this beautiful box (for input '+'):

+++
+ +
+++

RPL (Reverse Polish Lisp), 60 characters

→STR 1 4 START DUP NEXT " " + SWAP + 4 ROLLD + + SWAP 2 PICK

(Note that "→" is a single character on the HP48 and compatible calculators)

Would visually represent what you want by having three items on the stack:

3.: "###"
2.: "# #"
1.: "###"

If you insist to return it as one string, one has to add the newline characters as well and combine the strings, left as exercise to the next tester.

Explanation:

• →STR: Make the last object in the stack into a string. (So the input can be anything, e.g. a number.)
• 1 4: Push the number 1 and 4 to the stack.
• START [...] NEXT: Like a for loop but without access to the counter variable. Takes two numbers from the stack (here, we just have pushed 1 and 4) and executes the code [...] the corresponding times (here, four times).
• DUP: Duplicate the last entry in the stack.
• " ": Push the string (i.e. the string with one whitespace) to the stack.
• +: Take two objects from the stack and return them added together, for strings: Concatenated.
• 4: Push the number 4 to the stack.
• ROLLD: Takes the last element (here: 4 that we just have pushed) from the stack and rolls the next element as far down the stack as the number we just took from the stack specifies.
• SWAP: Swaps the two last stack elements.
• 2: Push 2 to the stack.
• PICK: Takes an element (here: The 2 we just pushed to the stack), interprets it as a number n, and copies the nth element from the stack.

Ruby, 27 25 bytes

Saved 2 bytes thanks to Level River St

->x{[s=x*3,x+" "+x,s]*$/}

Try it online!

05AB1E, 8 bytes

4×ð«û3ô»

Try it online!

INPUT    # ['R']                 | Implicit Input: 'R'
---------#-----------------------+-------------------------------
4×       # ['RRRR']              | Repeat string 4 times.     
  ð      # ['RRRR',' ']          | Push space onto top of stack.
   «     # ['RRRR ']             | Concatenate last 2 items.
    û    # ['RRRR RRRR']         | Palindromize.
     3ô  # [['RRR','R R','RRR']] | Split into 3 pieces.
       » # ['RRR\nR R\nRRR']     | Join with newlines
---------#-----------------------+-------------------------------
OUTPUT   # RRR                   | Implicitly print the top
         # R R                   | of the stack on exit.
         # RRR                   |

Original idea using 30 as a binary number (unfinished, someone else try this in another lang):

05AB1E, 12 bytes

30bûTIð«‡3ô»

Try it online!

Python 2, 32 bytes

lambda s:s+s.join(s+'\n \n'+s)+s

Try it online!
For s='a' : the middle s+'\n \n'+s generates a\n \na and s.join turns it in aa\na a\naa (bold as are the ones that .join adds), because .join accepts a string as an iterable, then it is surrounded with the two missing characters

C#, 30 bytes

s=>s+s+s+$"\n{s} {s}\n"+s+s+s;

Compiles to a Func<string, string>.

Using Replace for 32 bytes.

c=>@"###
# #
###".Replace('#',c);

Compiles to a Func<char, string>.

Befunge, 26 bytes

~:::25*\:84*\:25*\::>:#,_@

Try it online!

Explanation

~::          Take input and put bottom row in stack (: is duplicate)
:25*\:84*\   Create second row (25* is 10 or newline, 84* is 32 or space)
:25*\::      Create top row
>:#,_@       Print out stack until the stack is empty

the \ after the numbers is to switch the stack around since you need the input on 
top of the stack to duplicate it

C#, 74 71 66 bytes

m=>{System.Console.WriteLine("{0}{0}{0}\n{0} {0}\n{0}{0}{0}",m);};

golfed 5 bytes thanks to an anon

Retina, 18 bytes

:`$
$_$_
*2=`.

Half of this code looks like trailing empty lines, I like that :)

Try it online!

Explanation

There are three stages in this program, each of them prints a line of the output, in sequence.

:`$
$_$_

Add two more copies of the input at the end and print the resulting string.

*2=`.

There's a single space in the second line. This stage replaces the second character of the string with a space, prints the result, and then reverts the string to what it was before (thanks to the *)

The two final empty lines are a replacement stage with no effect. This is only needed because a final stage with no printing modifier implicitly prints the resulting string.

C (gcc), 49 47 bytes

Saved 2 bytes thanks to 2501!

j;f(i){for(j=12;j;)putchar(--j%4?j-6?i:32:10);}

Try it online! has a trailing newline

Foo, 40 bytes

&<character as ascii value>&3(-1<$c>)$c13<$c$c32$c$c13>&3(-1<$c>)

As Foo cannot take input, you should replace <character as ascii value> with the ASCII value of the character.

Try it online!

><>, 19 bytes

i:o:o:oao:$o" "|;o~

Try it online!

VBScript, 72 bytes

n=chr(10):msgbox replace("###"&n&"# #"&n&"###","#",wscript.arguments(0))

VBScript sucks ;-)

Scala, 23 bytes

a=>a*3+s"\n$a $a\n"+a*3

Accepts and returns a String. The s before a string literal allows you to use $-prefixed variables in it, or even ${expressions}. * repeats a String, like in Python.

Try it online!

bash, 43 38 bytes

read -sN1 x
echo "$x$x$x
$x $x
$x$x$x"

C#,50 bytes

a=>Console.Write(a+a+a+"\n"+a+" "+a+"\n"+a+a+a);

Test Case:

var f = new Action<string>(
a=>Console.Write(a+a+a+"\n"+a+" "+a+"\n"+a+a+a);
);
f("#");

Brain-Flak, 61, 59 bytes

(((((((({})))<([][][]())>)<(([][][]()){})>)<([]()()())>)))

Try it online!

This is 58 bytes of code +1 byte for the -c flag which enables ASCII input and output.

Explanation:

(((
   (
    (
     (

      #Duplicate the input 3 times
      ((({})))

#Push 10 (newline)
<([][][]())>

     #Push the input again
     )

#Push 32 (space)
<(([][][]()){})>

    #Push the input again
    )

#Push 10 (newline)
<([]()()())>)

#Push input 3 times
)))

Aceto, 19 bytes

nppk
pKLp
pppn
,kpp

Read a single character (,), then activate sticky mode (k). Print it three times, a newline and then the character again (pppnp).

Deactivate sticky mode (K), then load the empty string from quick storage (L), print it (p), activate sticky mode again (k), and print the rest (pnppp).

V, 8 bytes

x3p2Ùlr 

Try it online!

Swift3, 50 bytes

[1,2,3].map{$0==2 ? print(c+" "+c) : print(c+c+c)}

This uses the ternary operator to print different strings, depending on the row.

Try it online

Pyke, 5 bytes

dQA.X

Try it online!

Octave, 36 bytes

x=repmat(input(0),3);x(5)=32;disp(x)

Try it online!

Explanation

This creates a 3x3 char matrix with the input char repeated, and sets its 5th entry in column-major order (i.e. its center) to 32 (ASCII for space).

Pyth, 7 bytes

jc3.[9d

Try this online.

Explanation:

jc3.[9d Expects quoted input.
  3     3
     9  9
      d ' '
        Q (eval'd input) as implicit argument
   .[   Pad B on both sides with C until its length is a multiple of A
 c      Split B to chunks of length A, last chunk may be shorter
j       Join A on newlines

Carrot, 11 bytes

###
# #
###

Try it online!

The program is in caret-mode, where #s are replaced with the input.

Brain-Flak, 76 70 + 1 = 71 bytes

Requires the -c flag

(((((((({})))<((([])[]{}<>)<>)>)<(<>({})({}){}()()<>)>)<([]()()())>)))

Try it online!

><>, 24 23 bytes

i:o:o:oao:o84*o:a0!.<o$

Try it online!

Retina, 21 bytes

.
$&$&$&¶$& $&¶$&$&$&

Try it online!

JavaScript, 28 bytes

c=>c+c+c+`
${c} ${c}
`+c+c+c

Try it

f=
c=>c+c+c+`
${c} ${c}
`+c+c+c
o.innerText=f(i.value="#")
i.oninput=_=>o.innerText=f(i.value)

<input id=i maxlength=1><pre id=o>

sed, 28 18 bytes

s:.:&&&\n& &\n&&&:

Try it online!

Jelly, 8 bytes

1 byte thanks to Erik the Outgolfer.

x4,`Ks3Y

Try it online!

PHP, 32 Bytes

<?=strtr("000
0 0
000",0,$argn);

Try it online!

Braingolf, 34 20 bytes

...#
<.># <.>#
<..&@

Little disappointed that this isn't easily golfed. At least it's shorter than JavaScript

Explanation:

For input #

                   | [35]
...                | [35,35,35,35]
   #<newline>      | [35,35,35,35,10]
<.>                | [35,35,35,35,10,35]
   #<space>        | [35,35,35,35,10,35,32]
     <.>           | [35,35,35,35,10,35,32,35]
        #<newline> | [35,35,35,35,10,35,32,35,10]
<..                | [35,35,35,10,35,32,35,10,35,35,35]
   &@              | Print entire stack

35 = # ASCII value
10 = <newline> ASCII value
32 = <space> ASCII value

Output:
###
# #
###

Charcoal, 5 3 bytes

Ｂ³Ｓ

Try it online! Edit: Saved 40% thanks to @carusocomputing. Explanation:

Ｂ   Draw a box
³   3×3 (second dimension is implicit if omitted)
Ｓ   Using the input character

MATL, 5 bytes

3Y6*c

Try it online!

Explanation

3Y6   % Push predefined literal: [true true true; true false true; true true true]
*     % Implicitly input a character. Multiply element-wise by its code point
c     % Convert to char. Implicitly display. Char 0 is displayed as space

Java 7, 56 55 bytes

-1 Thanks to Leaky Nun for pointing out the space I missed

String a(char s){return"...\n. .\n...".replace('.',s);}

Simply replaces the periods with the given character, for input #:

...       ###
. .  =>   # #
...       ###

Try it online!

Python 3, 34 bytes

lambda s:s*3+"\n"+s+" "+s+"\n"+s*3

Try it online!