you send the server text; the server sends your browser HTML. That's the difference - the server is taking the text you sent, and allowing it to escape its text

you send the server text; the server sends your browser HTML. That's the difference - the server is taking the text you sent, and allowing it to escape its textual confines and become code/markup. HTML is nice enough to make this easy, where SQL servers have gone the way of parameterized queries to explicitly make this impossible (harder?)