Well, one feature that Yesod has really been focused on are type-safe URLs[1]. I imagine this would provide some level of security benefit as the framework know

Well, one feature that Yesod has really been focused on are type-safe URLs[1]. I imagine this would provide some level of security benefit as the framework knows "Ah, in this GET request we should have a Date, an Integer, a UserID, etc". The implementation may still have bugs, I suppose, but you can be sure that it's at least being heavily thought about. I imagine forms may work the same way, though I'm not sure about that. [1] http://www.yesodweb.com/home/snoyberg/blogs/2011/08/shakespeare/new-shakespeare-chapter.ditamap?nav=type-safe-urls http://www.yesodweb.com/home/snoyberg/blogs/2011/08/shakespe...