I have figured out that `<` wasn't encoded as `&lt;`.
However it is removed if followed by anything but a blank space. For example, `<a` will get removed but not `< a>` (note the space), which isn't useful.

Except from `<` character, there is no restriction and no encoded characters.

Here is the code where it gets reflected:

```
<span>USER INPUT</span>

```

Here is the content type of the page:

```
text/html; charset=utf-8

```

And the content type for the input request:

```
application/x-www-form-urlencoded; charset=UTF-8 

```

Others specific informations :

```
Server: nginx
X-Powered-By: PHP/5.5.18-1~dotdeb.1

```

Is this method vulnerable to XSS?