It's tricky. Note activity this week around getting XSS protection right http://weblog.rubyonrails.org/ http://weblog.rubyonrails.org/ I'm not that familiar w

It's tricky. Note activity this week around getting XSS protection right http://weblog.rubyonrails.org/ http://weblog.rubyonrails.org/ I'm not that familiar with lift and Yesod, but it seems like they're both able to use compile-time checks as additional layers of protection. https://github.com/dpp/liftweb/wiki/lifts-security https://github.com/dpp/liftweb/wiki/lifts-security