Characters that can break out of an inline value with double quotes
<input id="test" value="s$[chr]onload="alert(1)" />let a = document.getElementById("test");0x0D
if (typeof a.onload === 'function') {0x0D
log(String.fromCharCode($[i]))0x0D
}<input id="test" value="s0x00onload="alert(1)" />