Spinneret is better than CL-WHO at least in it's string escaping policy. All values are escaped by default whereas with CL-WHO you need to wrap with CL-WHO:ESC

Spinneret is better than CL-WHO at least in it's string escaping policy. All values are escaped by default whereas with CL-WHO you need to wrap with CL-WHO:ESC all string values. Thus CL-WHO is vulnerable to XSS attack by default.