This vector shows what characters are allowed in-between hyphens of a HTML comment.
<!-$[chr]- ><xmp>--><img src/onerror=log($[i])>-->
<!--- ><xmp>--><img src/onerror=alert(45)>-->
1
1
1
1