Fragment  165 bytes:   <section class="card">
    <h2>B2950 for Ma&#x27;ruf Saputra</h2>
    <p>Wash, dry &amp; fold (per kg). Status: <b>queued</b>. Balance Rp 48.000.</p>
  </section>

Json      132 bytes: {"bill":"B2950","customer":"Ma\u0027ruf Saputra","service":"Wash, dry \u0026 fold (per kg)","status":"queued","balance":"Rp 48.000"}
Check (thin)               shows: 'B2952 for <img src=x onerror="document.title=\'hacked\'">'  markup ran: no
Check (fat, innerHTML)     shows: 'B2952 for '                                                 markup ran: YES
Check (fat, textContent)   shows: 'B2952 for <img src=x onerror="document.title=\'hacked\'">'  markup ran: no
