I am trying to understand XSS. I have basic understanding of reflected, stored XSS and how they should work. In this particular case the code that i inject is getting returned in the source of the page but I do not get any prompt/pop-up like the usual alert. 

Say I inject `<script>alert("XSS")</script>`

But i can see the string that I passed return in the source. Is it possible to exploit it? is this behavior secure? 

Can anyone please help me understand this.