How to bypass ‘<’ ‘>’ transcoding? XSS attack [on hold]

Found a web which doesn’t have nickname limit, but certain characters like & < can be transcoded. How to bypass this?