Ah okay - so it uses some special type to represent html-encoded text, which is then valid to shove inside a text element? That sounds quite nice.
But of course this only applies when you use sxml. Artanis apparently can also use plain strings or templates as responses, in which case you will have to take care of safely encoding things too.
Rather, things are structured, so it's more like a in-memory representation of XML. It doesn't need to be serialised, only deserialised into XML's text syntax. In which case, each piece knows how it needs to be encoded.
'(h1 (@ (id "greeting")) "Hi, there")
Its just lists of Symbol types, and string or other type values. <script>alert("yoov bin acked")</script>
And that's my username, if it's naively inserted inside some HTML it'll look like HTML to a browser.So I was wondering if this framework auto-HTML-escapes strings inserted into places where text can go.