A colleague suggested to me just to prevent letter characters from occurring immediately after an opening angle bracket as a way to protect against XSS and HTML injection.
Obviously, this doesn't prevent issues such as:
<img src="%injectable%" />
But I can't think of a way around his suggestion.
Is it really that simple?
I think your example describes exactly why it isn't that simple. There are many forms of XSS, and quite a few of them don't rely on attackers injecting entire tags at all.
What Rook was getting at in his comment is that you should generally rely on a good existing XSS filter to deal with the threat rather than trying to piece one together your own, as your colleague seems to suggest.
White-listing the characters is always the best practice instead of black-listing special characters. I had seen the same thing with one of the apps I was assessing. So, I found an input parameter which showed in response at three different places. One of which was inside " " in a-tags. No wonder, XSS was easy there. And yes, already mentioned, many of the payloads don't have to use tags at all.
<script>,<style>… ) you are still vulnerable, so I don't understand you statement that you "can't think of a way around his suggestion" while showing a counter-example at the same time.