XSS alert not working with concatenated string

Question

I've noticed that the following Stored XSS does not execute, whereas in the JS console it works:

<img src=0 onerror=alert(document.domain+": "+Date.now())>

This doesn't prompt an alert box. Whereas the following do:

<img src=0 onerror=alert(Date.now())>
<img src=0 onerror=alert(document.domain)>

Casting any of the elements with String() doesn't help either.

The plain alert statement (alert(document.domain+": "+Date.now())) works in the Chrome JS console, in Firefox it works if I add the semicolon at the end.

I'm certainly no JS wizard, but I don't see why this doesn't work.

Why does the initial XSS via the image tag not work?

Answer 1

You have to remove space in ": " or add quotes for onerror attribute value:

<img src=0 onerror='alert(document.domain+": "+Date.now())'>

Answer 2

You put a quote in the original one. This messes up the HTML parser because " has special meaning inside the attribute space of a tag.

I'm wrong. It's the space.