This XSS vector shows what characters can be used before the onerror event.
Unable to render tweet button
<$[chr]img src onerror=log($[i])>
<<img src onerror=alert(60)>
1
1
1
1