Hello @amimulihsanmahdi and thanks for your reply.
Using an HTML block i found a suggestion about using dynamic smartcodes like
{dynamic.INPUT_NAME}
I found out that allows inline code execution as inputs are sanitized only on “submit”.
So when using a dynamic smartcode if you insert a value like
<script>window.alert("injection")</script>
you get the script executed inline.