A colleague suggested to me just to prevent letter characters from occurring immediately after an opening angle bracket as a way to protect against XSS and HTML injection.
Obviously, this doesn't prevent issues such as:
<img src="%injectable%" />
But I can't think of a way around his suggestion.
Is it really that simple?