Test mutated XSS in onerror event for image tag
<$[data1]><$[data2] title="</$[data1]><img/src/onerror=log('$[data1] $[data2]')>">