[jws]

The HTML tag closing rules specify they only get closed when they have to be. So neither of your solutions is correct. It is:

<div>foo<a>bar<span>baz box</span></a></div>

[adelevie]

my solution was to merely demonstrate the difference between what a programmer writes and what gets sent as an http response.