Is allowing Full HTML input for all user roles safe as long as I enable the HTML filter?
Only trusted roles and users should have access to Full HTML. You can add some additional allowed tags to the Filtered HTML input format but don't add too many or you risk creating a vulnerability. (admin/settings/filters)
It doesn't really matter what the name of the input format is, if "untrusted" users (see a defintion of trusted roles) are allowed to enter unsafe HTML tags then your site is unsafe.
You can make the Filtered HTML input format unsafe by adding the wrong tags to it or make the "Full HTML" input format more safe by changing its configuration.
I suggest installing the Security Review module and configuring it to know which roles of your site you trust. It will then analyze your input formats to see which are safe and which are not. It also has documentation and links to further resources if it determines that some of your input formats are unsafe. One great resource is the handbook page on configuring input formats for safety.
If you want to make a different input format the default for your admins vs. your regular users, try the Better Formats module.
protected by kiamlaluno♦ Aug 6 '12 at 21:29
Thank you for your interest in this question.
Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).
Would you like to answer one of these unanswered questions instead?