Yesod also has automatic html-escaping of strings, enforced at the type level. You have to explicitly tell it when a value is raw html, to avoid XSS. It also ha

Yesod also has automatic html-escaping of strings, enforced at the type level. You have to explicitly tell it when a value is raw html, to avoid XSS. It also has automatic XSRF prevention.