"%22+H.attr(%22src%22)+%22" The URI you submitted has disallowed characters.