Fragment  145 bytes: <section class="card"><h2>B2950 for Ma'ruf Saputra</h2>
<p>Wash, dry &amp; fold (per kg). Status: <b>queued</b>. Balance Rp 48.000.</p></section>
Json      127 bytes: {"bill":"B2950","customer":"Ma'ruf Saputra","service":"Wash, dry \u0026 fold (per kg)","status":"queued","balance":"Rp 48.000"}
Check (thin)               shows: 'B2952 for <img src=x onerror="document.title=\'hacked\'">'  markup ran: no
Check (fat, innerHTML)     shows: 'B2952 for '                                                 markup ran: YES
Check (fat, textContent)   shows: 'B2952 for <img src=x onerror="document.title=\'hacked\'">'  markup ran: no
