anchor.diff:    For the HTML to be interpreted, we must bind to an HTML property, such as `innerHTML`. But binding
     a potentially attacker controlled value into `innerHTML` would normally cause an XSS
     vulnerability. For example, code contained in a `<script>` tag would be executed.
  -+makeExample('security/ts/app/inner-html-binding.component.ts', 'inner-html-controller')(format=".")
  +
  ++makeExcerpt('app/inner-html-binding.component.ts ()', 'inner-html-controller')
  +
   :marked
     Angular recognizes the value as unsafe, and automatically sanitizes it. It removes the `<script>`
     tag but keeps safe content, such as the text content of the `<script>` tag, or the `<b>` element.
  
positive.code:   your intended use of the value. Imagine the following template needs to bind a URL to a
    `javascript:alert(...)` call.
  
  +makeExample('security/ts/app/bypass-security.component.html', 'dangerous-url')(format=".")
  :marked
    Normally, Angular would automatically sanitize the URL and disable the dangerous code. To prevent
    this, we can mark the URL value as a trusted URL using the `bypassSecurityTrustUrl` call:
  
  +makeExample('security/ts/app/bypass-security.component.ts', 'trust-url')(format=".")
  figure.image-display
      img(src='/resources/images/devguide/security/bypass-security-component.png'
          alt='A screenshot showing an alert box created from a trusted URL')
  :marked
    If we need to convert user input into a trusted value, it can be convenient to do so in a
    controller method. The template below allows users to enter a YouTube video ID, and load the
  
negative.code:   ### Server side XSS protection
  
    HTML constructed on the server is vulnerable to injection attacks. Injecting template code into an
    Angular application is the same as injecting executable code into the
    application; it gives the attacker full control over the application. To prevent this, make sure
    to use a templating language that automatically escapes values to prevent XSS vulnerabilities on
    the server. Do not generate Angular templates on the server side using a templating language, this
  