XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security.
Test Reflected XSS with a list of payloads
Combinaning vulnerable Applications, xvwa,dwapp