HTML Purifier Variable Width Attack Smoketest

For more information, see Cheng Peng Su's original advisory. This particular exploit code appears only to work in Internet Explorer, if it works at all.

Test

ASCIIRawOutputRender
0 <img src="" alt="X">A"onerror=alert('0')>O <img src="" alt="X" />A"onerror=alert('0')&gt;O XA"onerror=alert('0')>O
1 <img src="" alt="X">A"onerror=alert('1')>O <img src="" alt="X" />A"onerror=alert('1')&gt;O XA"onerror=alert('1')>O
2 <img src="" alt="X">A"onerror=alert('2')>O <img src="" alt="X" />A"onerror=alert('2')&gt;O XA"onerror=alert('2')>O
3 <img src="" alt="X">A"onerror=alert('3')>O <img src="" alt="X" />A"onerror=alert('3')&gt;O XA"onerror=alert('3')>O
4 <img src="" alt="X">A"onerror=alert('4')>O <img src="" alt="X" />A"onerror=alert('4')&gt;O XA"onerror=alert('4')>O
5 <img src="" alt="X">A"onerror=alert('5')>O <img src="" alt="X" />A"onerror=alert('5')&gt;O XA"onerror=alert('5')>O
6 <img src="" alt="X">A"onerror=alert('6')>O <img src="" alt="X" />A"onerror=alert('6')&gt;O XA"onerror=alert('6')>O
7 <img src="" alt="X">A"onerror=alert('7')>O <img src="" alt="X" />A"onerror=alert('7')&gt;O XA"onerror=alert('7')>O
8 <img src="" alt="X">A"onerror=alert('8')>O <img src="" alt="X" />A"onerror=alert('8')&gt;O XA"onerror=alert('8')>O
9 <img src="" alt="X ">A"onerror=alert('9')>O <img src="" alt="X" />A"onerror=alert('9')&gt;O XA"onerror=alert('9')>O
10 <img src="" alt="X ">A"onerror=alert('10')>O <img src="" alt="X" />A"onerror=alert('10')&gt;O XA"onerror=alert('10')>O
11 <img src="" alt="X">A"onerror=alert('11')>O <img src="" alt="X" />A"onerror=alert('11')&gt;O XA"onerror=alert('11')>O
12 <img src="" alt="X">A"onerror=alert('12')>O <img src="" alt="X" />A"onerror=alert('12')&gt;O XA"onerror=alert('12')>O
13 <img src="" alt="X ">A"onerror=alert('13')>O <img src="" alt="X" />A"onerror=alert('13')&gt;O XA"onerror=alert('13')>O
14 <img src="" alt="X">A"onerror=alert('14')>O <img src="" alt="X" />A"onerror=alert('14')&gt;O XA"onerror=alert('14')>O
15 <img src="" alt="X">A"onerror=alert('15')>O <img src="" alt="X" />A"onerror=alert('15')&gt;O XA"onerror=alert('15')>O
16 <img src="" alt="X">A"onerror=alert('16')>O <img src="" alt="X" />A"onerror=alert('16')&gt;O XA"onerror=alert('16')>O
17 <img src="" alt="X">A"onerror=alert('17')>O <img src="" alt="X" />A"onerror=alert('17')&gt;O XA"onerror=alert('17')>O
18 <img src="" alt="X">A"onerror=alert('18')>O <img src="" alt="X" />A"onerror=alert('18')&gt;O XA"onerror=alert('18')>O
19 <img src="" alt="X">A"onerror=alert('19')>O <img src="" alt="X" />A"onerror=alert('19')&gt;O XA"onerror=alert('19')>O
20 <img src="" alt="X">A"onerror=alert('20')>O <img src="" alt="X" />A"onerror=alert('20')&gt;O XA"onerror=alert('20')>O
21 <img src="" alt="X">A"onerror=alert('21')>O <img src="" alt="X" />A"onerror=alert('21')&gt;O XA"onerror=alert('21')>O
22 <img src="" alt="X">A"onerror=alert('22')>O <img src="" alt="X" />A"onerror=alert('22')&gt;O XA"onerror=alert('22')>O
23 <img src="" alt="X">A"onerror=alert('23')>O <img src="" alt="X" />A"onerror=alert('23')&gt;O XA"onerror=alert('23')>O
24 <img src="" alt="X">A"onerror=alert('24')>O <img src="" alt="X" />A"onerror=alert('24')&gt;O XA"onerror=alert('24')>O
25 <img src="" alt="X">A"onerror=alert('25')>O <img src="" alt="X" />A"onerror=alert('25')&gt;O XA"onerror=alert('25')>O
26 <img src="" alt="X">A"onerror=alert('26')>O <img src="" alt="X" />A"onerror=alert('26')&gt;O XA"onerror=alert('26')>O
27 <img src="" alt="X">A"onerror=alert('27')>O <img src="" alt="X" />A"onerror=alert('27')&gt;O XA"onerror=alert('27')>O
28 <img src="" alt="X">A"onerror=alert('28')>O <img src="" alt="X" />A"onerror=alert('28')&gt;O XA"onerror=alert('28')>O
29 <img src="" alt="X">A"onerror=alert('29')>O <img src="" alt="X" />A"onerror=alert('29')&gt;O XA"onerror=alert('29')>O
30 <img src="" alt="X">A"onerror=alert('30')>O <img src="" alt="X" />A"onerror=alert('30')&gt;O XA"onerror=alert('30')>O
31 <img src="" alt="X">A"onerror=alert('31')>O <img src="" alt="X" />A"onerror=alert('31')&gt;O XA"onerror=alert('31')>O
32 <img src="" alt="X ">A"onerror=alert('32')>O <img src="" alt="X" />A"onerror=alert('32')&gt;O XA"onerror=alert('32')>O
33 <img src="" alt="X!">A"onerror=alert('33')>O <img src="" alt="X!" />A"onerror=alert('33')&gt;O X!A"onerror=alert('33')>O
34 <img src="" alt="X"">A"onerror=alert('34')>O <img src="" alt="X" />A"onerror=alert('34')&gt;O XA"onerror=alert('34')>O
35 <img src="" alt="X#">A"onerror=alert('35')>O <img src="" alt="X#" />A"onerror=alert('35')&gt;O X#A"onerror=alert('35')>O
36 <img src="" alt="X$">A"onerror=alert('36')>O <img src="" alt="X$" />A"onerror=alert('36')&gt;O X$A"onerror=alert('36')>O
37 <img src="" alt="X%">A"onerror=alert('37')>O <img src="" alt="X%" />A"onerror=alert('37')&gt;O X%A"onerror=alert('37')>O
38 <img src="" alt="X&">A"onerror=alert('38')>O <img src="" alt="X&amp;" />A"onerror=alert('38')&gt;O X&A"onerror=alert('38')>O
39 <img src="" alt="X'">A"onerror=alert('39')>O <img src="" alt="X'" />A"onerror=alert('39')&gt;O X'A"onerror=alert('39')>O
40 <img src="" alt="X(">A"onerror=alert('40')>O <img src="" alt="X(" />A"onerror=alert('40')&gt;O X(A"onerror=alert('40')>O
41 <img src="" alt="X)">A"onerror=alert('41')>O <img src="" alt="X)" />A"onerror=alert('41')&gt;O X)A"onerror=alert('41')>O
42 <img src="" alt="X*">A"onerror=alert('42')>O <img src="" alt="X*" />A"onerror=alert('42')&gt;O X*A"onerror=alert('42')>O
43 <img src="" alt="X+">A"onerror=alert('43')>O <img src="" alt="X+" />A"onerror=alert('43')&gt;O X+A"onerror=alert('43')>O
44 <img src="" alt="X,">A"onerror=alert('44')>O <img src="" alt="X," />A"onerror=alert('44')&gt;O X,A"onerror=alert('44')>O
45 <img src="" alt="X-">A"onerror=alert('45')>O <img src="" alt="X-" />A"onerror=alert('45')&gt;O X-A"onerror=alert('45')>O
46 <img src="" alt="X.">A"onerror=alert('46')>O <img src="" alt="X." />A"onerror=alert('46')&gt;O X.A"onerror=alert('46')>O
47 <img src="" alt="X/">A"onerror=alert('47')>O <img src="" alt="X/" />A"onerror=alert('47')&gt;O X/A"onerror=alert('47')>O
48 <img src="" alt="X0">A"onerror=alert('48')>O <img src="" alt="X0" />A"onerror=alert('48')&gt;O X0A"onerror=alert('48')>O
49 <img src="" alt="X1">A"onerror=alert('49')>O <img src="" alt="X1" />A"onerror=alert('49')&gt;O X1A"onerror=alert('49')>O
50 <img src="" alt="X2">A"onerror=alert('50')>O <img src="" alt="X2" />A"onerror=alert('50')&gt;O X2A"onerror=alert('50')>O
51 <img src="" alt="X3">A"onerror=alert('51')>O <img src="" alt="X3" />A"onerror=alert('51')&gt;O X3A"onerror=alert('51')>O
52 <img src="" alt="X4">A"onerror=alert('52')>O <img src="" alt="X4" />A"onerror=alert('52')&gt;O X4A"onerror=alert('52')>O
53 <img src="" alt="X5">A"onerror=alert('53')>O <img src="" alt="X5" />A"onerror=alert('53')&gt;O X5A"onerror=alert('53')>O
54 <img src="" alt="X6">A"onerror=alert('54')>O <img src="" alt="X6" />A"onerror=alert('54')&gt;O X6A"onerror=alert('54')>O
55 <img src="" alt="X7">A"onerror=alert('55')>O <img src="" alt="X7" />A"onerror=alert('55')&gt;O X7A"onerror=alert('55')>O
56 <img src="" alt="X8">A"onerror=alert('56')>O <img src="" alt="X8" />A"onerror=alert('56')&gt;O X8A"onerror=alert('56')>O
57 <img src="" alt="X9">A"onerror=alert('57')>O <img src="" alt="X9" />A"onerror=alert('57')&gt;O X9A"onerror=alert('57')>O
58 <img src="" alt="X:">A"onerror=alert('58')>O <img src="" alt="X:" />A"onerror=alert('58')&gt;O X:A"onerror=alert('58')>O
59 <img src="" alt="X;">A"onerror=alert('59')>O <img src="" alt="X;" />A"onerror=alert('59')&gt;O X;A"onerror=alert('59')>O
60 <img src="" alt="X<">A"onerror=alert('60')>O <img src="" alt="X&lt;" />A"onerror=alert('60')&gt;O X<A"onerror=alert('60')>O
61 <img src="" alt="X=">A"onerror=alert('61')>O <img src="" alt="X=" />A"onerror=alert('61')&gt;O X=A"onerror=alert('61')>O
62 <img src="" alt="X>">A"onerror=alert('62')>O <img src="" alt="X&gt;" />A"onerror=alert('62')&gt;O X>A"onerror=alert('62')>O
63 <img src="" alt="X?">A"onerror=alert('63')>O <img src="" alt="X?" />A"onerror=alert('63')&gt;O X?A"onerror=alert('63')>O
64 <img src="" alt="X@">A"onerror=alert('64')>O <img src="" alt="X@" />A"onerror=alert('64')&gt;O X@A"onerror=alert('64')>O
65 <img src="" alt="XA">A"onerror=alert('65')>O <img src="" alt="XA" />A"onerror=alert('65')&gt;O XAA"onerror=alert('65')>O
66 <img src="" alt="XB">A"onerror=alert('66')>O <img src="" alt="XB" />A"onerror=alert('66')&gt;O XBA"onerror=alert('66')>O
67 <img src="" alt="XC">A"onerror=alert('67')>O <img src="" alt="XC" />A"onerror=alert('67')&gt;O XCA"onerror=alert('67')>O
68 <img src="" alt="XD">A"onerror=alert('68')>O <img src="" alt="XD" />A"onerror=alert('68')&gt;O XDA"onerror=alert('68')>O
69 <img src="" alt="XE">A"onerror=alert('69')>O <img src="" alt="XE" />A"onerror=alert('69')&gt;O XEA"onerror=alert('69')>O
70 <img src="" alt="XF">A"onerror=alert('70')>O <img src="" alt="XF" />A"onerror=alert('70')&gt;O XFA"onerror=alert('70')>O
71 <img src="" alt="XG">A"onerror=alert('71')>O <img src="" alt="XG" />A"onerror=alert('71')&gt;O XGA"onerror=alert('71')>O
72 <img src="" alt="XH">A"onerror=alert('72')>O <img src="" alt="XH" />A"onerror=alert('72')&gt;O XHA"onerror=alert('72')>O
73 <img src="" alt="XI">A"onerror=alert('73')>O <img src="" alt="XI" />A"onerror=alert('73')&gt;O XIA"onerror=alert('73')>O
74 <img src="" alt="XJ">A"onerror=alert('74')>O <img src="" alt="XJ" />A"onerror=alert('74')&gt;O XJA"onerror=alert('74')>O
75 <img src="" alt="XK">A"onerror=alert('75')>O <img src="" alt="XK" />A"onerror=alert('75')&gt;O XKA"onerror=alert('75')>O
76 <img src="" alt="XL">A"onerror=alert('76')>O <img src="" alt="XL" />A"onerror=alert('76')&gt;O XLA"onerror=alert('76')>O
77 <img src="" alt="XM">A"onerror=alert('77')>O <img src="" alt="XM" />A"onerror=alert('77')&gt;O XMA"onerror=alert('77')>O
78 <img src="" alt="XN">A"onerror=alert('78')>O <img src="" alt="XN" />A"onerror=alert('78')&gt;O XNA"onerror=alert('78')>O
79 <img src="" alt="XO">A"onerror=alert('79')>O <img src="" alt="XO" />A"onerror=alert('79')&gt;O XOA"onerror=alert('79')>O
80 <img src="" alt="XP">A"onerror=alert('80')>O <img src="" alt="XP" />A"onerror=alert('80')&gt;O XPA"onerror=alert('80')>O
81 <img src="" alt="XQ">A"onerror=alert('81')>O <img src="" alt="XQ" />A"onerror=alert('81')&gt;O XQA"onerror=alert('81')>O
82 <img src="" alt="XR">A"onerror=alert('82')>O <img src="" alt="XR" />A"onerror=alert('82')&gt;O XRA"onerror=alert('82')>O
83 <img src="" alt="XS">A"onerror=alert('83')>O <img src="" alt="XS" />A"onerror=alert('83')&gt;O XSA"onerror=alert('83')>O
84 <img src="" alt="XT">A"onerror=alert('84')>O <img src="" alt="XT" />A"onerror=alert('84')&gt;O XTA"onerror=alert('84')>O
85 <img src="" alt="XU">A"onerror=alert('85')>O <img src="" alt="XU" />A"onerror=alert('85')&gt;O XUA"onerror=alert('85')>O
86 <img src="" alt="XV">A"onerror=alert('86')>O <img src="" alt="XV" />A"onerror=alert('86')&gt;O XVA"onerror=alert('86')>O
87 <img src="" alt="XW">A"onerror=alert('87')>O <img src="" alt="XW" />A"onerror=alert('87')&gt;O XWA"onerror=alert('87')>O
88 <img src="" alt="XX">A"onerror=alert('88')>O <img src="" alt="XX" />A"onerror=alert('88')&gt;O XXA"onerror=alert('88')>O
89 <img src="" alt="XY">A"onerror=alert('89')>O <img src="" alt="XY" />A"onerror=alert('89')&gt;O XYA"onerror=alert('89')>O
90 <img src="" alt="XZ">A"onerror=alert('90')>O <img src="" alt="XZ" />A"onerror=alert('90')&gt;O XZA"onerror=alert('90')>O
91 <img src="" alt="X[">A"onerror=alert('91')>O <img src="" alt="X[" />A"onerror=alert('91')&gt;O X[A"onerror=alert('91')>O
92 <img src="" alt="X\">A"onerror=alert('92')>O <img src="" alt="X\" />A"onerror=alert('92')&gt;O X\A"onerror=alert('92')>O
93 <img src="" alt="X]">A"onerror=alert('93')>O <img src="" alt="X]" />A"onerror=alert('93')&gt;O X]A"onerror=alert('93')>O
94 <img src="" alt="X^">A"onerror=alert('94')>O <img src="" alt="X^" />A"onerror=alert('94')&gt;O X^A"onerror=alert('94')>O
95 <img src="" alt="X_">A"onerror=alert('95')>O <img src="" alt="X_" />A"onerror=alert('95')&gt;O X_A"onerror=alert('95')>O
96 <img src="" alt="X`">A"onerror=alert('96')>O <img src="" alt="X` " />A"onerror=alert('96')&gt;O X` A"onerror=alert('96')>O
97 <img src="" alt="Xa">A"onerror=alert('97')>O <img src="" alt="Xa" />A"onerror=alert('97')&gt;O XaA"onerror=alert('97')>O
98 <img src="" alt="Xb">A"onerror=alert('98')>O <img src="" alt="Xb" />A"onerror=alert('98')&gt;O XbA"onerror=alert('98')>O
99 <img src="" alt="Xc">A"onerror=alert('99')>O <img src="" alt="Xc" />A"onerror=alert('99')&gt;O XcA"onerror=alert('99')>O
100 <img src="" alt="Xd">A"onerror=alert('100')>O <img src="" alt="Xd" />A"onerror=alert('100')&gt;O XdA"onerror=alert('100')>O
101 <img src="" alt="Xe">A"onerror=alert('101')>O <img src="" alt="Xe" />A"onerror=alert('101')&gt;O XeA"onerror=alert('101')>O
102 <img src="" alt="Xf">A"onerror=alert('102')>O <img src="" alt="Xf" />A"onerror=alert('102')&gt;O XfA"onerror=alert('102')>O
103 <img src="" alt="Xg">A"onerror=alert('103')>O <img src="" alt="Xg" />A"onerror=alert('103')&gt;O XgA"onerror=alert('103')>O
104 <img src="" alt="Xh">A"onerror=alert('104')>O <img src="" alt="Xh" />A"onerror=alert('104')&gt;O XhA"onerror=alert('104')>O
105 <img src="" alt="Xi">A"onerror=alert('105')>O <img src="" alt="Xi" />A"onerror=alert('105')&gt;O XiA"onerror=alert('105')>O
106 <img src="" alt="Xj">A"onerror=alert('106')>O <img src="" alt="Xj" />A"onerror=alert('106')&gt;O XjA"onerror=alert('106')>O
107 <img src="" alt="Xk">A"onerror=alert('107')>O <img src="" alt="Xk" />A"onerror=alert('107')&gt;O XkA"onerror=alert('107')>O
108 <img src="" alt="Xl">A"onerror=alert('108')>O <img src="" alt="Xl" />A"onerror=alert('108')&gt;O XlA"onerror=alert('108')>O
109 <img src="" alt="Xm">A"onerror=alert('109')>O <img src="" alt="Xm" />A"onerror=alert('109')&gt;O XmA"onerror=alert('109')>O
110 <img src="" alt="Xn">A"onerror=alert('110')>O <img src="" alt="Xn" />A"onerror=alert('110')&gt;O XnA"onerror=alert('110')>O
111 <img src="" alt="Xo">A"onerror=alert('111')>O <img src="" alt="Xo" />A"onerror=alert('111')&gt;O XoA"onerror=alert('111')>O
112 <img src="" alt="Xp">A"onerror=alert('112')>O <img src="" alt="Xp" />A"onerror=alert('112')&gt;O XpA"onerror=alert('112')>O
113 <img src="" alt="Xq">A"onerror=alert('113')>O <img src="" alt="Xq" />A"onerror=alert('113')&gt;O XqA"onerror=alert('113')>O
114 <img src="" alt="Xr">A"onerror=alert('114')>O <img src="" alt="Xr" />A"onerror=alert('114')&gt;O XrA"onerror=alert('114')>O
115 <img src="" alt="Xs">A"onerror=alert('115')>O <img src="" alt="Xs" />A"onerror=alert('115')&gt;O XsA"onerror=alert('115')>O
116 <img src="" alt="Xt">A"onerror=alert('116')>O <img src="" alt="Xt" />A"onerror=alert('116')&gt;O XtA"onerror=alert('116')>O
117 <img src="" alt="Xu">A"onerror=alert('117')>O <img src="" alt="Xu" />A"onerror=alert('117')&gt;O XuA"onerror=alert('117')>O
118 <img src="" alt="Xv">A"onerror=alert('118')>O <img src="" alt="Xv" />A"onerror=alert('118')&gt;O XvA"onerror=alert('118')>O
119 <img src="" alt="Xw">A"onerror=alert('119')>O <img src="" alt="Xw" />A"onerror=alert('119')&gt;O XwA"onerror=alert('119')>O
120 <img src="" alt="Xx">A"onerror=alert('120')>O <img src="" alt="Xx" />A"onerror=alert('120')&gt;O XxA"onerror=alert('120')>O
121 <img src="" alt="Xy">A"onerror=alert('121')>O <img src="" alt="Xy" />A"onerror=alert('121')&gt;O XyA"onerror=alert('121')>O
122 <img src="" alt="Xz">A"onerror=alert('122')>O <img src="" alt="Xz" />A"onerror=alert('122')&gt;O XzA"onerror=alert('122')>O
123 <img src="" alt="X{">A"onerror=alert('123')>O <img src="" alt="X{" />A"onerror=alert('123')&gt;O X{A"onerror=alert('123')>O
124 <img src="" alt="X|">A"onerror=alert('124')>O <img src="" alt="X|" />A"onerror=alert('124')&gt;O X|A"onerror=alert('124')>O
125 <img src="" alt="X}">A"onerror=alert('125')>O <img src="" alt="X}" />A"onerror=alert('125')&gt;O X}A"onerror=alert('125')>O
126 <img src="" alt="X~">A"onerror=alert('126')>O <img src="" alt="X~" />A"onerror=alert('126')&gt;O X~A"onerror=alert('126')>O
127 <img src="" alt="X">A"onerror=alert('127')>O <img src="" alt="X" />A"onerror=alert('127')&gt;O XA"onerror=alert('127')>O
128 <img src="" alt="X">A"onerror=alert('128')>O <img src="" alt="X" />A"onerror=alert('128')&gt;O XA"onerror=alert('128')>O
129 <img src="" alt="X">A"onerror=alert('129')>O <img src="" alt="X" />A"onerror=alert('129')&gt;O XA"onerror=alert('129')>O
130 <img src="" alt="X">A"onerror=alert('130')>O <img src="" alt="X" />A"onerror=alert('130')&gt;O XA"onerror=alert('130')>O
131 <img src="" alt="X">A"onerror=alert('131')>O <img src="" alt="X" />A"onerror=alert('131')&gt;O XA"onerror=alert('131')>O
132 <img src="" alt="X">A"onerror=alert('132')>O <img src="" alt="X" />A"onerror=alert('132')&gt;O XA"onerror=alert('132')>O
133 <img src="" alt="X">A"onerror=alert('133')>O <img src="" alt="X" />A"onerror=alert('133')&gt;O XA"onerror=alert('133')>O
134 <img src="" alt="X">A"onerror=alert('134')>O <img src="" alt="X" />A"onerror=alert('134')&gt;O XA"onerror=alert('134')>O
135 <img src="" alt="X">A"onerror=alert('135')>O <img src="" alt="X" />A"onerror=alert('135')&gt;O XA"onerror=alert('135')>O
136 <img src="" alt="X">A"onerror=alert('136')>O <img src="" alt="X" />A"onerror=alert('136')&gt;O XA"onerror=alert('136')>O
137 <img src="" alt="X">A"onerror=alert('137')>O <img src="" alt="X" />A"onerror=alert('137')&gt;O XA"onerror=alert('137')>O
138 <img src="" alt="X">A"onerror=alert('138')>O <img src="" alt="X" />A"onerror=alert('138')&gt;O XA"onerror=alert('138')>O
139 <img src="" alt="X">A"onerror=alert('139')>O <img src="" alt="X" />A"onerror=alert('139')&gt;O XA"onerror=alert('139')>O
140 <img src="" alt="X">A"onerror=alert('140')>O <img src="" alt="X" />A"onerror=alert('140')&gt;O XA"onerror=alert('140')>O
141 <img src="" alt="X">A"onerror=alert('141')>O <img src="" alt="X" />A"onerror=alert('141')&gt;O XA"onerror=alert('141')>O
142 <img src="" alt="X">A"onerror=alert('142')>O <img src="" alt="X" />A"onerror=alert('142')&gt;O XA"onerror=alert('142')>O
143 <img src="" alt="X">A"onerror=alert('143')>O <img src="" alt="X" />A"onerror=alert('143')&gt;O XA"onerror=alert('143')>O
144 <img src="" alt="X">A"onerror=alert('144')>O <img src="" alt="X" />A"onerror=alert('144')&gt;O XA"onerror=alert('144')>O
145 <img src="" alt="X">A"onerror=alert('145')>O <img src="" alt="X" />A"onerror=alert('145')&gt;O XA"onerror=alert('145')>O
146 <img src="" alt="X">A"onerror=alert('146')>O <img src="" alt="X" />A"onerror=alert('146')&gt;O XA"onerror=alert('146')>O
147 <img src="" alt="X">A"onerror=alert('147')>O <img src="" alt="X" />A"onerror=alert('147')&gt;O XA"onerror=alert('147')>O
148 <img src="" alt="X">A"onerror=alert('148')>O <img src="" alt="X" />A"onerror=alert('148')&gt;O XA"onerror=alert('148')>O
149 <img src="" alt="X">A"onerror=alert('149')>O <img src="" alt="X" />A"onerror=alert('149')&gt;O XA"onerror=alert('149')>O
150 <img src="" alt="X">A"onerror=alert('150')>O <img src="" alt="X" />A"onerror=alert('150')&gt;O XA"onerror=alert('150')>O
151 <img src="" alt="X">A"onerror=alert('151')>O <img src="" alt="X" />A"onerror=alert('151')&gt;O XA"onerror=alert('151')>O
152 <img src="" alt="X">A"onerror=alert('152')>O <img src="" alt="X" />A"onerror=alert('152')&gt;O XA"onerror=alert('152')>O
153 <img src="" alt="X">A"onerror=alert('153')>O <img src="" alt="X" />A"onerror=alert('153')&gt;O XA"onerror=alert('153')>O
154 <img src="" alt="X">A"onerror=alert('154')>O <img src="" alt="X" />A"onerror=alert('154')&gt;O XA"onerror=alert('154')>O
155 <img src="" alt="X">A"onerror=alert('155')>O <img src="" alt="X" />A"onerror=alert('155')&gt;O XA"onerror=alert('155')>O
156 <img src="" alt="X">A"onerror=alert('156')>O <img src="" alt="X" />A"onerror=alert('156')&gt;O XA"onerror=alert('156')>O
157 <img src="" alt="X">A"onerror=alert('157')>O <img src="" alt="X" />A"onerror=alert('157')&gt;O XA"onerror=alert('157')>O
158 <img src="" alt="X">A"onerror=alert('158')>O <img src="" alt="X" />A"onerror=alert('158')&gt;O XA"onerror=alert('158')>O
159 <img src="" alt="X">A"onerror=alert('159')>O <img src="" alt="X" />A"onerror=alert('159')&gt;O XA"onerror=alert('159')>O
160 <img src="" alt="X">A"onerror=alert('160')>O <img src="" alt="X" />A"onerror=alert('160')&gt;O XA"onerror=alert('160')>O
161 <img src="" alt="X">A"onerror=alert('161')>O <img src="" alt="X" />A"onerror=alert('161')&gt;O XA"onerror=alert('161')>O
162 <img src="" alt="X">A"onerror=alert('162')>O <img src="" alt="X" />A"onerror=alert('162')&gt;O XA"onerror=alert('162')>O
163 <img src="" alt="X">A"onerror=alert('163')>O <img src="" alt="X" />A"onerror=alert('163')&gt;O XA"onerror=alert('163')>O
164 <img src="" alt="X">A"onerror=alert('164')>O <img src="" alt="X" />A"onerror=alert('164')&gt;O XA"onerror=alert('164')>O
165 <img src="" alt="X">A"onerror=alert('165')>O <img src="" alt="X" />A"onerror=alert('165')&gt;O XA"onerror=alert('165')>O
166 <img src="" alt="X">A"onerror=alert('166')>O <img src="" alt="X" />A"onerror=alert('166')&gt;O XA"onerror=alert('166')>O
167 <img src="" alt="X">A"onerror=alert('167')>O <img src="" alt="X" />A"onerror=alert('167')&gt;O XA"onerror=alert('167')>O
168 <img src="" alt="X">A"onerror=alert('168')>O <img src="" alt="X" />A"onerror=alert('168')&gt;O XA"onerror=alert('168')>O
169 <img src="" alt="X">A"onerror=alert('169')>O <img src="" alt="X" />A"onerror=alert('169')&gt;O XA"onerror=alert('169')>O
170 <img src="" alt="X">A"onerror=alert('170')>O <img src="" alt="X" />A"onerror=alert('170')&gt;O XA"onerror=alert('170')>O
171 <img src="" alt="X">A"onerror=alert('171')>O <img src="" alt="X" />A"onerror=alert('171')&gt;O XA"onerror=alert('171')>O
172 <img src="" alt="X">A"onerror=alert('172')>O <img src="" alt="X" />A"onerror=alert('172')&gt;O XA"onerror=alert('172')>O
173 <img src="" alt="X">A"onerror=alert('173')>O <img src="" alt="X" />A"onerror=alert('173')&gt;O XA"onerror=alert('173')>O
174 <img src="" alt="X">A"onerror=alert('174')>O <img src="" alt="X" />A"onerror=alert('174')&gt;O XA"onerror=alert('174')>O
175 <img src="" alt="X">A"onerror=alert('175')>O <img src="" alt="X" />A"onerror=alert('175')&gt;O XA"onerror=alert('175')>O
176 <img src="" alt="X">A"onerror=alert('176')>O <img src="" alt="X" />A"onerror=alert('176')&gt;O XA"onerror=alert('176')>O
177 <img src="" alt="X">A"onerror=alert('177')>O <img src="" alt="X" />A"onerror=alert('177')&gt;O XA"onerror=alert('177')>O
178 <img src="" alt="X">A"onerror=alert('178')>O <img src="" alt="X" />A"onerror=alert('178')&gt;O XA"onerror=alert('178')>O
179 <img src="" alt="X">A"onerror=alert('179')>O <img src="" alt="X" />A"onerror=alert('179')&gt;O XA"onerror=alert('179')>O
180 <img src="" alt="X">A"onerror=alert('180')>O <img src="" alt="X" />A"onerror=alert('180')&gt;O XA"onerror=alert('180')>O
181 <img src="" alt="X">A"onerror=alert('181')>O <img src="" alt="X" />A"onerror=alert('181')&gt;O XA"onerror=alert('181')>O
182 <img src="" alt="X">A"onerror=alert('182')>O <img src="" alt="X" />A"onerror=alert('182')&gt;O XA"onerror=alert('182')>O
183 <img src="" alt="X">A"onerror=alert('183')>O <img src="" alt="X" />A"onerror=alert('183')&gt;O XA"onerror=alert('183')>O
184 <img src="" alt="X">A"onerror=alert('184')>O <img src="" alt="X" />A"onerror=alert('184')&gt;O XA"onerror=alert('184')>O
185 <img src="" alt="X">A"onerror=alert('185')>O <img src="" alt="X" />A"onerror=alert('185')&gt;O XA"onerror=alert('185')>O
186 <img src="" alt="X">A"onerror=alert('186')>O <img src="" alt="X" />A"onerror=alert('186')&gt;O XA"onerror=alert('186')>O
187 <img src="" alt="X">A"onerror=alert('187')>O <img src="" alt="X" />A"onerror=alert('187')&gt;O XA"onerror=alert('187')>O
188 <img src="" alt="X">A"onerror=alert('188')>O <img src="" alt="X" />A"onerror=alert('188')&gt;O XA"onerror=alert('188')>O
189 <img src="" alt="X">A"onerror=alert('189')>O <img src="" alt="X" />A"onerror=alert('189')&gt;O XA"onerror=alert('189')>O
190 <img src="" alt="X">A"onerror=alert('190')>O <img src="" alt="X" />A"onerror=alert('190')&gt;O XA"onerror=alert('190')>O
191 <img src="" alt="X">A"onerror=alert('191')>O <img src="" alt="X" />A"onerror=alert('191')&gt;O XA"onerror=alert('191')>O
192 <img src="" alt="X>A"onerror=alert('192')>O <img src="" alt="X&gt;A" />O X>AO
193 <img src="" alt="X>A"onerror=alert('193')>O <img src="" alt="X&gt;A" />O X>AO
194 <img src="" alt="X>A"onerror=alert('194')>O <img src="" alt="X&gt;A" />O X>AO
195 <img src="" alt="X>A"onerror=alert('195')>O <img src="" alt="X&gt;A" />O X>AO
196 <img src="" alt="X>A"onerror=alert('196')>O <img src="" alt="X&gt;A" />O X>AO
197 <img src="" alt="X>A"onerror=alert('197')>O <img src="" alt="X&gt;A" />O X>AO
198 <img src="" alt="X>A"onerror=alert('198')>O <img src="" alt="X&gt;A" />O X>AO
199 <img src="" alt="X>A"onerror=alert('199')>O <img src="" alt="X&gt;A" />O X>AO
200 <img src="" alt="X>A"onerror=alert('200')>O <img src="" alt="X&gt;A" />O X>AO
201 <img src="" alt="X>A"onerror=alert('201')>O <img src="" alt="X&gt;A" />O X>AO
202 <img src="" alt="X>A"onerror=alert('202')>O <img src="" alt="X&gt;A" />O X>AO
203 <img src="" alt="X>A"onerror=alert('203')>O <img src="" alt="X&gt;A" />O X>AO
204 <img src="" alt="X>A"onerror=alert('204')>O <img src="" alt="X&gt;A" />O X>AO
205 <img src="" alt="X>A"onerror=alert('205')>O <img src="" alt="X&gt;A" />O X>AO
206 <img src="" alt="X>A"onerror=alert('206')>O <img src="" alt="X&gt;A" />O X>AO
207 <img src="" alt="X>A"onerror=alert('207')>O <img src="" alt="X&gt;A" />O X>AO
208 <img src="" alt="X>A"onerror=alert('208')>O <img src="" alt="X&gt;A" />O X>AO
209 <img src="" alt="X>A"onerror=alert('209')>O <img src="" alt="X&gt;A" />O X>AO
210 <img src="" alt="X>A"onerror=alert('210')>O <img src="" alt="X&gt;A" />O X>AO
211 <img src="" alt="X>A"onerror=alert('211')>O <img src="" alt="X&gt;A" />O X>AO
212 <img src="" alt="X>A"onerror=alert('212')>O <img src="" alt="X&gt;A" />O X>AO
213 <img src="" alt="X>A"onerror=alert('213')>O <img src="" alt="X&gt;A" />O X>AO
214 <img src="" alt="X>A"onerror=alert('214')>O <img src="" alt="X&gt;A" />O X>AO
215 <img src="" alt="X>A"onerror=alert('215')>O <img src="" alt="X&gt;A" />O X>AO
216 <img src="" alt="X>A"onerror=alert('216')>O <img src="" alt="X&gt;A" />O X>AO
217 <img src="" alt="X>A"onerror=alert('217')>O <img src="" alt="X&gt;A" />O X>AO
218 <img src="" alt="X>A"onerror=alert('218')>O <img src="" alt="X&gt;A" />O X>AO
219 <img src="" alt="X>A"onerror=alert('219')>O <img src="" alt="X&gt;A" />O X>AO
220 <img src="" alt="X>A"onerror=alert('220')>O <img src="" alt="X&gt;A" />O X>AO
221 <img src="" alt="X>A"onerror=alert('221')>O <img src="" alt="X&gt;A" />O X>AO
222 <img src="" alt="X>A"onerror=alert('222')>O <img src="" alt="X&gt;A" />O X>AO
223 <img src="" alt="X>A"onerror=alert('223')>O <img src="" alt="X&gt;A" />O X>AO
224 <img src="" alt="X>A"onerror=alert('224')>O <img src="" alt="X&gt;A" />O X>AO
225 <img src="" alt="X>A"onerror=alert('225')>O <img src="" alt="X&gt;A" />O X>AO
226 <img src="" alt="X>A"onerror=alert('226')>O <img src="" alt="X&gt;A" />O X>AO
227 <img src="" alt="X>A"onerror=alert('227')>O <img src="" alt="X&gt;A" />O X>AO
228 <img src="" alt="X>A"onerror=alert('228')>O <img src="" alt="X&gt;A" />O X>AO
229 <img src="" alt="X>A"onerror=alert('229')>O <img src="" alt="X&gt;A" />O X>AO
230 <img src="" alt="X>A"onerror=alert('230')>O <img src="" alt="X&gt;A" />O X>AO
231 <img src="" alt="X>A"onerror=alert('231')>O <img src="" alt="X&gt;A" />O X>AO
232 <img src="" alt="X>A"onerror=alert('232')>O <img src="" alt="X&gt;A" />O X>AO
233 <img src="" alt="X>A"onerror=alert('233')>O <img src="" alt="X&gt;A" />O X>AO
234 <img src="" alt="X>A"onerror=alert('234')>O <img src="" alt="X&gt;A" />O X>AO
235 <img src="" alt="X>A"onerror=alert('235')>O <img src="" alt="X&gt;A" />O X>AO
236 <img src="" alt="X>A"onerror=alert('236')>O <img src="" alt="X&gt;A" />O X>AO
237 <img src="" alt="X>A"onerror=alert('237')>O <img src="" alt="X&gt;A" />O X>AO
238 <img src="" alt="X>A"onerror=alert('238')>O <img src="" alt="X&gt;A" />O X>AO
239 <img src="" alt="X>A"onerror=alert('239')>O <img src="" alt="X&gt;A" />O X>AO
240 <img src="" alt="X>A"onerror=alert('240')>O <img src="" alt="X&gt;A" />O X>AO
241 <img src="" alt="X>A"onerror=alert('241')>O <img src="" alt="X&gt;A" />O X>AO
242 <img src="" alt="X>A"onerror=alert('242')>O <img src="" alt="X&gt;A" />O X>AO
243 <img src="" alt="X>A"onerror=alert('243')>O <img src="" alt="X&gt;A" />O X>AO
244 <img src="" alt="X>A"onerror=alert('244')>O <img src="" alt="X&gt;A" />O X>AO
245 <img src="" alt="X>A"onerror=alert('245')>O <img src="" alt="X&gt;A" />O X>AO
246 <img src="" alt="X>A"onerror=alert('246')>O <img src="" alt="X&gt;A" />O X>AO
247 <img src="" alt="X>A"onerror=alert('247')>O <img src="" alt="X&gt;A" />O X>AO
248 <img src="" alt="X>A"onerror=alert('248')>O <img src="" alt="X&gt;A" />O X>AO
249 <img src="" alt="X>A"onerror=alert('249')>O <img src="" alt="X&gt;A" />O X>AO
250 <img src="" alt="X>A"onerror=alert('250')>O <img src="" alt="X&gt;A" />O X>AO
251 <img src="" alt="X>A"onerror=alert('251')>O <img src="" alt="X&gt;A" />O X>AO
252 <img src="" alt="X>A"onerror=alert('252')>O <img src="" alt="X&gt;A" />O X>AO
253 <img src="" alt="X>A"onerror=alert('253')>O <img src="" alt="X&gt;A" />O X>AO
254 <img src="" alt="X">A"onerror=alert('254')>O <img src="" alt="X" />A"onerror=alert('254')&gt;O XA"onerror=alert('254')>O
255 <img src="" alt="X">A"onerror=alert('255')>O <img src="" alt="X" />A"onerror=alert('255')&gt;O XA"onerror=alert('255')>O

Analysis

By making sure that UTF-8 is well formed and non-SGML codepoints are removed, as well as escaping quotes outside of tags, this is a non-threat.