For starters, the HTML input tag in this case is set to restrict input to 15 characters, so your standard <script>alert(1);</script> won't fit. This can probably be circumvented by using an attack proxy such as OWASP ZAP or Burbsuite, which will allow you to submit responses that wouldn't normally be accepted.
There is no way to tell what server-side filters are in place by simply looking at the HTML code. HTML is client-side, and client-side security can almost always be bypassed. (Much like the character limit described above.) It is likely that there are multiple layers of filtering that go on in the server after you submit the form.
There are two steps that you should try. First, rather than starting off with a whole payload script, try just entering specific characters and combinations of characters, such as < and >. See what characters get filtered out, and which ones become encoded or remain unfiltered. Then try to craft an attack string that will bypass the filtering or is the decoded form of what you actually want.
The other thing you should do is to run a fuzzer on the application. This will try a very large number of different attack strings, to try to find one that gets by the filtering.
