I have done a commenting system based on entries. It works fine but I would like to allow to registered users to do basic formatting on their comments. What type of checking is done on the Rich Text Field? Is it protected by SQL Injection or XSS?
For obvious reasons, the Rich Text Field is the only field type that Craft will return the "raw" content for, meaning exactly what was saved in the database. All other field types will get automatically encoded by Twig on output.
If you're accepting guest input from a Rich Text Field on the front-end, you'll probably want to have it post to a plugin and run it through CHtmlPurifier to remove any malicious looking bits before getting saved to the database.
$purifier = new \CHtmlPurifier(); $purifier->purify($html)