buddy

Hiccup has functionality to perform escaping with `h`. It doesn't do it by default though, for performance reasons and nesting of Hiccup in Hiccup. Normally, you'd just want to sanitize right before returning your response. Doing it that way you can also perform more selective sanitation if needed. Hiccup2 does sanitation by default, still in beta though. The common SQL lib is java.jdbc or next.jdbc and they use prepared statements by default. Can you explain more where you see common risks for SQL injections? I'm not sure what you mean by bad password and session management? Normally, the common lib people use is ring-defaults https://github.com/ring-clojure/ring-defaults what about these do you feel are insufficient? Maybe do a pull request about it. Auth and encryption I agree, but the untold reason is that people just use Java bountyc

> I found the ecosystem incredibly immature This does not match my experience at all. There is a thing called sane defaults. You solve a problem by decomposing it to simple elements, and then combine them to sane defaults, while still giving full power to your users. Examples of sane defaults in areas you mention: - authorization/authentication: buddy (https://github.com/funcool/buddy) has both core library with crypto stuff and complimentary libraries for auth etc. For example, if you want to securely hash a password, you don't have to come up with salting yourself, just use buddy-hashers: http://funcool.github.io/buddy-hashers/latest/#quickstart - sql: clojure.java.jdbc and it's successor next-jdbc for sql queries use vector with query string containing question marks for arguments and then arguments that get escaped, see select example

compojure-api[1] is great for building a REST API, and I really like HugSQL[2] for talking to databases. Buddy[3] is good for handling auth. [1]: https://github.com/metosin/compojure-api [2]: https://www.hugsql.org/ [3]: https://github.com/funcool/buddy