anchor.diff:    your intended use of the value. Imagine the following template needs to bind a URL to a
     `javascript:alert(...)` call.
   
  -+makeExample('security/ts/app/bypass-security.component.html', 'dangerous-url')(format=".")
  -:marked
  -  Normally, Angular would automatically sanitize the URL and disable the dangerous code. To prevent
  ++makeExcerpt('app/bypass-security.component.html ()', 'dangerous-url')
  +
  +:marked
  +  Normally, Angular automatically sanitizes the URL, disables the dangerous code and,
  +  in development mode, logs this action to the console. To prevent
     this, we can mark the URL value as a trusted URL using the `bypassSecurityTrustUrl` call:
   
  -+makeExample('security/ts/app/bypass-security.component.ts', 'trust-url')(format=".")
  ++makeExcerpt('app/bypass-security.component.ts ()', 'trust-url')
  +
   figure.image-display
       img(src='/resources/images/devguide/security/bypass-security-component.png'
           alt='A screenshot showing an alert box created from a trusted URL')
  +
   :marked
     If we need to convert user input into a trusted value, it can be convenient to do so in a
     controller method. The template below allows users to enter a YouTube video ID, and load the
  
positive.code:   would execute. So we call a method on the controller to construct a trusted video URL, which
    Angular then allows binding into `<iframe src>`.
  
  +makeExample('security/ts/app/bypass-security.component.html', 'iframe-videoid')(format=".")
  +makeExample('security/ts/app/bypass-security.component.ts', 'trust-video-url')(format=".")
  
  .l-main-section
  h2#http HTTP-level Vulnerabilities
  
negative.code:   ### Server side XSS protection
  
    HTML constructed on the server is vulnerable to injection attacks. Injecting template code into an
    Angular application is the same as injecting executable code into the
    application; it gives the attacker full control over the application. To prevent this, make sure
    to use a templating language that automatically escapes values to prevent XSS vulnerabilities on
    the server. Do not generate Angular templates on the server side using a templating language, this
  