It's hard to come up with a vector without having the actual vulnerability in front of me, but in the past, when I've faced such problems, I've gone the non-alphanumeric way to exploit it. This blog has an excellent description of how it is done. A few vectors are in this pastie as well.
I'm going to assume you have a way to execute scripts, but you just need the correct payload to execute. From the blog referenced above:
Since JavaScript has two different syntactic forms to access properties, you can access an Object method like a dictionary:
object.method(arguments) === object["method"](arguments)
So going with this method, your payload could then be something like:
this["alert"]("xss")
If you want to pull out the cookie, you could also use
this["alert"](this["document"]["cookie"])
Using either of these methods should hopefully get you the code execution you're looking for. These don't have spaces or slashes - thought you would still need to be within an attribute of some sort, or you should have the ability to enclose it in <script>
tags. In some browsers, you could try something like <script>{your vector}<script>
, and it might work (I remember it working for me on IE a while ago)
EDIT: If this is just a proof of concept for an input validation vulnerability, you could also embed an iFrame. Again, depending on the browser, iFrames don't need closing tags. so <iframe\src='www.google.com'>
might just do the job.