Prerequisite
Before getting started one should be familiar with XSS or at least have an idea about it. Here is a good article which you ...
For further actions, you may consider blocking this person and/or reporting abuse
I don't know why but
''!<button><button onclick=alert()>hi</button>is also working. I tried thinking but I am unable to comprehend why this is working