Hacker News new | ask | show | jobs
by svetlyak40wt 1004 days ago
Spinneret is better than CL-WHO at least in it's string escaping policy. All values are escaped by default whereas with CL-WHO you need to wrap with CL-WHO:ESC all string values.

Thus CL-WHO is vulnerable to XSS attack by default.