It is safe as long as you have a smart programmer checking all the input. This *has* to be turned off in any ASP.NET app where you want to be able to enter HTML in a textbox, so we don't really have a choice. But rest assured I am diligent about validating all the input and am confident it is secure.
You will notice that even with this setting disabled you are still severely restricted as to the HTML that can be entered for an external object. To enter a YouTube snippet, you will have to add a few tags to a couple settings in the Site admin area. Go ahead and try it and follow the directions in the error message.
Also note that you cannot enter *any* HTML for album/media object captions (there is a setting to turn this on, though).
To learn more about how GSP filters HTML input read this
blog entry.
Roger Martin
Creator and Lead Developer of Gallery Server Pro