The hints of XSS game's level2 say that
the resulting HTML after submiting is
<td valign="top" class="message-container"> <div class="shim"></div> <b>You</b><span class="date">Wed May 18 2016 </span> <blockquote><script>alert(91)</script></blockquote> </td>
and the XSS is not triggered. If I replace it with
post-content=<img src='foobar' onerror='alert("xss")'>
I've copied the whole HTML to a separate file on my computer, run the first case and the script fired!
So what is different from case 1 to case 2? Should case 1 work too?