Your parsing isn't too great. Try posting this: <img src=x onerror=alert(123) />