Comment by svetlyak40wt

Spinneret is better than CL-WHO at least in it's string escaping policy. All values are escaped by default whereas with CL-WHO you need to wrap with CL-WHO:ESC all string values.

Thus CL-WHO is vulnerable to XSS attack by default.