Yes. Programs in your path could call setuid or change your hostname (like "su") - you should check the username and hostname before printing the prompt each time.

Yes. There may be commands such as "ls < input | grep > output" but never "ls | grep > output" (only one level of redirection)