A colleague suggested to me just to prevent letter characters from occurring immediately after an opening angle bracket as a way to protect against XSS and HTML injection.
Obviously, this doesn't prevent issues such as:
<img src="%injectable%" />
But I can't think of a way around his suggestion.
Is it really that simple?
<style>… ) you are still vulnerable, so I don't understand you statement that you "can't think of a way around his suggestion" while showing a counter-example at the same time.