Xss when I save html document : <p>When entering</p>

<pre><code>&lt;script&gt;alert(1)&lt;/script&gt;
</code></pre>

<p>The resulting Html after submitting is</p>

<pre><code>&lt;form action="/action_page.php"  novalidate&gt;
  E-mail: &lt;input type="email"  Id="user_email"&gt;"&lt;script&gt;alert(1)&lt;/script&gt;
  &lt;input type="submit"&gt;
&lt;/form&gt;
</code></pre>

<p>And the xss not triggered.
If I replace the payload with </p>

<pre><code>&lt;img src=xss onerror=alert(1)&gt;
</code></pre>

<p>Xss triggered! 
this xss happening with the id attribute! 
In browsers.</p>

<p>So I want to know 2 thing.</p>

<ol>
<li><p>If this is a vulnerability then how an attacker can use it. I mean what payload would be used. Cause xss happening with <code>Id=</code> attribute</p></li>
<li><p>If this is a vulnerability. How can I fix it? </p></li>
</ol>

<p>I am a beginner. I will be happy if you guys answer my question. </p>

<p>Thanks.</p>
