3 ms·

For level 2, onerror="javascript:alert(0)" a whole lot simpler than your pasted answer.

• flanbiscuit 10y ago
  that didn't work for me. this did: <img onload="javascript:alert(0);" src="http://i.imgur.com/fXYSkbC.gif"> http://i.imgur.com/fXYSkbC.gif"> img tags support the onload attribute and is a typical element people use in posts
  • 9point6 10y ago
    weird, onerror worked fine for me <img src="404me" onerror="alert('test')" />
  • cfontes 10y ago
    You used onload, the suggested was onerror, Maybe it doesn't work because the page is already loaded so the onload is never run.