Ironically applications that bypass HTML entirely and use JavaScript to build up the DOM (e.x. Cappuccino apps) are largely immune to XSS attacks (as long as you avoid innerHTML and such)