1. Marker first (test123), then devtools → find it: inside a <textarea>.
2. Throw a classic payload (<img src=x onerror=alert(2)>) at it — nothing. Also try a plain closing bracket — nothing.
3. Why: inside a textarea the browser treats everything as pure text. Valid HTML doesn't matter in there.
4. So don't fight it — leave the textarea first, then inject.
5. Lesson rule: copy/pasted payloads fail silently in context. Read the context.

https://stuxnet.pro/xss/lab6/index.php?name=</textarea><img src=x onerror=alert(2)>

Same logic as the lesson: close </textarea>, then run your own HTML+JS outside of it. This is why context matters more than the payload you memorized.