Consider this straightforward Angular snippet:
<input type="text" ng-model="name" />
<p>Hello {{name}}</p>
When entering the text
<script>document.write("Hello World!");</script>
, it appears to be displayed as is without being executed. However, upon inspecting the generated HTML code, I notice that the script tag remains unescaped.
I would have expected Angular to display the angular brackets as HTML escape characters. How does Angular ensure that this code is not executed?
(Check out the Plunker at http://plnkr.co/DeUCP74RZSGE2ypLqyRY)