xss_test.html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>XSS test</title>
</head>
<body>
    <h1>Check console.</h1>

    <!-- HTML Entities -->
    <a href='j&#x41;vascript:console.log("HTML &#x45;ntity")'>hoge</a>

    <!-- URL Encoding -->
    <a href="javascript:al%65rt('URL Encoding')">fuga</a>

    <script>
        // unicode encoding.
        \u0063onsole.log("\u0061")

        // hex encoding.
        eval('\x63onsole.log("\x63")')
    </script>
</body>
</html>