Sometimes when I'm bored I like to trawl low-budget sites

File: Screen Shot 2017-03-11 at 10.11.53 pm.png (20KB, 485x47px) Image search: [Google]

20KB, 485x47px

Sometimes when I'm bored I like to trawl low-budget sites for XSS (and if I'm lucky, SQL injection) vulnerability.

I've recently noticed that some sites seem to do something interesting. I enter my payload into an input or wherever will reflect it back when I submit the form and the webpage simply echoes the payload onto the page instead of executing it.

See pic: non-coloured text is the string I have entered.
First I tried with just

<script>

tags but after that didn't work, I figured I needed to escape the

<h2>

tags.

Is this the website itself refusing to execute it, or Chrome?

Because there's no reason that shouldn't execute otherwise. It's valid HTML.