anchor.diff:    For the HTML to be interpreted, we must bind to an HTML property, such as `innerHTML`. But binding
     a potentially attacker controlled value into `innerHTML` would normally cause an XSS
     vulnerability. For example, code contained in a `<script>` tag would be executed.
  -+makeExample('security/ts/app/inner-html-binding.component.ts', 'inner-html-controller')(format=".")
  +
  ++makeExcerpt('app/inner-html-binding.component.ts ()', 'inner-html-controller')
  +
   :marked
     Angular recognizes the value as unsafe, and automatically sanitizes it. It removes the `<script>`
     tag but keeps safe content, such as the text content of the `<script>` tag, or the `<b>` element.
  
positive.code:   ### Server side XSS protection
  
    HTML constructed on the server is vulnerable to injection attacks. Injecting template code into an
    Angular application is the same as injecting executable code (e.g., JavaScript) into the
    application; it gives the attacker full control over the application. To prevent this, make sure
    to use a templating language that automatically escapes values to prevent XSS vulnerabilities on
    the server. Do not generate Angular templates on the server side using a templating language, this
  
negative.code:   The template below binds the value of `htmlSnippet`, once by interpolating it into an element's
    content, and once by binding it to the `innerHTML` property of an element.
  
  +makeExample('app/inner-html-binding.component.html')
  
  :marked
    Interpolated content is always escaped - the HTML is not interpreted, and the browser displays
  