Is allowing Full HTML (HTML filter on) input for all user roles safe? Is allowing Full HTML input for all user roles safe as long as I enable the HTML filter?
Only trusted roles and users should have access to Full HTML. You can add some additional allowed tags to the Filtered HTML input format but don't add too many or you risk creating a vulnerability. (admin/settings/filters)