XSSMARK<img src=x onerror=alert(1)><svg onload=ale...

That appears to be an XSS test payload. Rendered safely as text:

XSSMARK<img src=x onerror=alert(1)><svg onload=alert(2)><b>B7</b>

The <img> and <svg> handlers attempt to execute JavaScript; <b>B7</b> is just HTML formatting.

This is another mixed XSS/scheme-injection test payload. Interpreted as text, it contains:

[J1](javascript:alert(1)) [J2](JaVaScRiPt:alert(2)) [J3](data:text/html,x) ![I1](javascript:alert(4)) <img src=x onerror=alert(5)> [J5](vbscript:alert(6))

The risky parts are the javascript:, mixed-case JaVaScRiPt:, data:text/html, and vbscript: URL schemes, plus the HTML-escaped <img ... onerror=...> payload if something later decodes it and inserts it as HTML.

A robust sanitizer should normalize scheme casing, block active/non-HTTP URL schemes, keep escaped HTML escaped, and never pass user-controlled markup into an unsafe HTML sink.