As with any, we try inserting our canary into the form to see what comes. In this case we will try searching for ihvkjueb"<>& Notice that while the angle brackets are encoded, " isn’t. And we can escape the value attribute and add it this payload:

" autofocus onfocus='alert(1)'

This will autofocus the input form right after the page loads, which will trigger alert calls indefinitely.