anchor.diff:  
       <form action="csp" id="cspForm" method="post">
           <fieldset>
  -            <legend>+ Content Security Policy (CSP)</legend>
  +            <legend>With Content Security Policy (CSP)</legend>
               <label for="cspName">Name</label>
               <input type="text" id="cspName" name="cspName" />
               <input type="submit" value=" Send" />
  
positive.code: 
      <form action="validated" id="validatedForm" method="post">
          <fieldset>
              <legend>+ Input Validation</legend>
              <label for="inputValidatedName">Name</label>
              <input type="text" id="inputValidatedName" name="inputValidatedName" pattern="^[^<>]+$" />
              <input type="submit" value=" Send" />
  
negative.code: 
      <form action="escaped.jsp" id="escapedJSPForm" method="post">
          <fieldset>
              <legend>With JSP Output Escaping</legend>
              <label for="outputEscapedJSPName">Name</label>
              <input type="text" id="outputEscapedJSPName" name="outputEscapedJSPName" />
              <input type="submit" value=" Send" />
  