Test sanitised user input with this list of possible vectors of attack

UserInputTest.txt

// Javascript
<script>alert('Test');<script>

// PHP
<?php echo 'Test echo 1'; ?>
<?= 'Test echo 2' ?>
<?php include('non_existent_file'); ?>
<?php require('non_existent_file'); ?>

// HTML
<div>You should see div tags</div>
<span>You should see span tags</span>
<b>You may want to see b tags</b>
<i>You may want to see i tags</i>
<u>You may want to see u tags</u>
<strong>You may want to see strong tags</strong>
<em>You may want to see em tags</em>
You <br> may <br /> want to see br tags – otherwise this line should be split up

Use this cheatsheet for more:
https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet