Characters that function as attribute separators inside HTML tags.
<img$[chr]onerror=alert() src=x />
1
1
1