HTML5 Security Cheatsheet (heideri.ch)

don't forget

    ' & >

But not all of these can: http://ha.ckers.org/xss.html. This is an older, but much more complete list.

Or perhaps a [:white, :grey, :black].sort_by{rand}.first hat attack vector list? Penetration testers love this stuff, as do I. At my job, I educate developers by documenting things like this. It helps them be aware of what crazy stuff is out there.