Fragment  149 bytes: <section class="card"><h2>B2950 for Ma&#39;ruf Saputra</h2>
<p>Wash, dry &amp; fold (per kg). Status: <b>queued</b>. Balance Rp 48.000.</p></section>
Json      123 bytes: {"balance":"Rp 48.000","bill":"B2950","customer":"Ma'ruf Saputra","service":"Wash, dry & fold (per kg)","status":"queued"}

Check (thin)               shows: 'B2952 for <img src=x onerror="document.title=\'hacked\'">'  markup ran: no
Check (fat, innerHTML)     shows: 'B2952 for '                                                 markup ran: YES
Check (fat, textContent)   shows: 'B2952 for <img src=x onerror="document.title=\'hacked\'">'  markup ran: no
