anchor.diff:    ### Server side XSS protection
   
     HTML constructed on the server is vulnerable to injection attacks. Injecting template code into an
  -  Angular application is the same as injecting executable code (e.g., JavaScript) into the
  +  Angular application is the same as injecting executable code into the
     application; it gives the attacker full control over the application. To prevent this, make sure
     to use a templating language that automatically escapes values to prevent XSS vulnerabilities on
     the server. Do not generate Angular templates on the server side using a templating language, this
  
positive.code:   The template below binds the value of `htmlSnippet`, once by interpolating it into an element's
    content, and once by binding it to the `innerHTML` property of an element.
  
  +makeExcerpt('app/inner-html-binding.component.html')
  
  :marked
    Interpolated content is always escaped - the HTML is not interpreted, and the browser displays
  
negative.code:   For the HTML to be interpreted, we must bind to an HTML property, such as `innerHTML`. But binding
    a potentially attacker controlled value into `innerHTML` would normally cause an XSS
    vulnerability. For example, code contained in a `<script>` tag would be executed.
  
  +makeExcerpt('app/inner-html-binding.component.ts ()', 'inner-html-controller')
  
  :marked
    Angular recognizes the value as unsafe, and automatically sanitizes it. It removes the `<script>`
    tag but keeps safe content, such as the text content of the `<script>` tag, or the `<b>` element.
  