For an university project I have to perform an analysis on a web application to find out XSS vulnerabilities.
After this I have to report and create automatic test to prove vulnerabilities that I have discovered.

I've discovered a stored XSS vulnerability which affects a database field declared as **varchar(20)** and, in order to demonstrate it, I've used `<h1>Attack!</h1>` as an attack vector and this is sufficient for my task.

My question is about an hypotetic real scenario: how could I craft an effective attack vector with the limitation of only 20 characters.
Is it possible? How? 

Could someone provide an hypotetic example?

Thank you.