Exactly. It troubles me that all four suggestions for the backend have very few inherent checks and leave a lot of room for security problems and other bugs. P

Exactly. It troubles me that all four suggestions for the backend have very few inherent checks and leave a lot of room for security problems and other bugs. Personally, I prefer Yesod for the backend. It gives a very fast, static binary. It requires learning Haskell. The Haskell package Esqueleto ensures type safety all the way from the HTTP requests to the database tables. A URI parameter that is encoded to be a key on a table can only be used when querying that particular column or columns that are foreign keys to it.