User: Alice & Bob

Safe HTML: <script>alert('XSS')</script>

Unsafe HTML: <span>Test</span>