On: Is Haskell a Good Choice for Web Applications? (2009)

[joeyh]

Yesod also has automatic html-escaping of strings, enforced at the type level. You have to explicitly tell it when a value is raw html, to avoid XSS. It also has automatic XSRF prevention.