So I'm working on a game in C++ and I was debating whether I should use lua or xml to help me. I'll need a way to store all my data for the characters. It'll be a small pokemon like rpg. So everything has stats, moves it can learn when it levels up, experience to next level, etc etc.

I could set that up in an array, record, or something to hold all of this. But I was wondering if xml or lua would be possible to do this as well and make life easier for me. But as I looked more into it I thought this might give the user too much access if I set it up wrong.

What kind of instance would using lua or xml be proper time to use it? Could I use it to hold the config settings?

You can surely use Lua for something like this. It's probably a bit overpowered for such a purpose but it's a pragmatic solution to the problem. If you want to go one step further, you might also be able to implement item-specific behaviour in Lua, which would be quite cool and make your game easily moddable.

XML would be another option, but my personal taste is to use as little XML as possible, because it's hard to read and write (again, personal taste) by hand.

I wouldn't care about giving the user to much access. Unless you have some legal reasons to protect your data, just don't. Just be happy about the fact that people will be able to mod your game, which can be a great amplifier for your community.

I usually implement my configuration files using Lua, because that gives me a lot of possibilities and flexibility at a very low price (in terms of implementation effort needed).

I could set that up in an array, record, or something to hold all of this. But I was wondering if xml or lua would be possible to do this as well and make life easier for me. But as I looked more into it I thought this might give the user too much access if I set it up wrong.

What kind of instance would using lua or xml be proper time to use it? Could I use it to hold the config settings?

I find Lua to be highly useful for this kind of data description. XML is as well; however, it is unwieldy to type by hand, and is typically chosen as an intermediate output from a data-authoring tool rather than a first-choice for by-hand authoring. (Of course, such a tool can easily output Lua as well...)

Don't worry about giving the user too much access. Even a custom binary format is probably going to be cracked, if the game is interesting enough to motivate people to do so. You can crunch your data to binary (Lua provides a compiler to pre-compile scripts to a binary format) then run it through a simple encryption/decryption process at save/load time if it is really a concern; just be aware that if there is sufficient motivation to do so, your formats will still be cracked and your game modded by people who enjoy that sort of thing.

If the bulk of the stats are the same across all types of creatures it's best to make a table based format which can be imported / exported from common spread sheet programs like google docs or access. This allows you to keep the data organized. If a creature needs a custom non-standard attribute or property u can probably extend your system to support custom scripts ( Lua ) in the place of of a standard property / stat..