JSFiddle - React, Tailwind, and code Playground

HTML

<html>
  <!--
  C#
  var arg = "x');var a = \"\";alert('y');// style=background-image:url(http://malicious.website/badscript.php); ";
	//arg = Microsoft.Security.Application.Encoder.JavaScriptEncode(arg, false);
  //arg = System.Web.HttpUtility.JavaScriptStringEncode(arg);
	//arg = System.Web.HttpUtility.HtmlEncode(arg);
	//arg = AntiXssEncoder.HtmlEncode(arg);
	var html = "<div onclick=\"javascript:alert('" + arg + "')\">";
  -->

  <!-- HttpUtility HTML encode -->
  <!-- <div onclick="javascript:alert('x&#39;);var a = &quot;&quot;;alert(&#39;y&#39;);// style=background-image:url(http://malicious.website/badscript.php); ')"> -->
  
  <!-- AntiXss HTML encode -->
  <!-- <div onclick="javascript:alert('x&#39;);var a = &quot;&quot;;alert(&#39;y&#39;);// style=background-image:url(http://malicious.website/badscript.php); ')"> -->
  
  <!-- Microsoft Encoder -->
  <!-- <div onclick="javascript:alert('x\x27\x29\x3bvar a \x3d \x22\x22\x3balert\x28\x27y\x27\x29\x3b\x2f\x2f style\x3dbackground-image\x3aurl\x28http\x3a\x2f\x2fmalicious.website\x2fbadscript.php\x29\x3b ')"> -->
  
  <!-- HttpUtility JS encode -->
  <!-- <div onclick="javascript:alert('x\u0027);var a = \"\";alert(\u0027y\u0027);// style=background-image:url(http://malicious.website/badscript.php); ')"> -->
  
  <!-- HttpUtility JS encode + HttpUtility HTML encode -->
  <!-- <div onclick="javascript:alert('x\u0027);var a = \&quot;\&quot;;alert(\u0027y\u0027);// style=background-image:url(http://malicious.website/badscript.php); ')"> -->

  <!-- replace the following opening tag -->
  <div>
    XXX
  </div>
</html>